gcb-host 0.1.0 → 0.2.0

package/lib/daemon.js

@@ -1,7 +1,18 @@
+/**
+ * Daemon entry point logic: load configuration, build providers, serve the socket.
+ *
+ * Startup is fail-fast on purpose. A broker that cannot read its private key, or whose
+ * configuration is over-broad or malformed, must not come up and quietly serve nothing — an
+ * operator has to see the failure. `--check` performs the same validation and provider
+ * construction without binding the socket, which is what a deployment script should run
+ * before restarting the service.
+ */
+import { createHash } from 'node:crypto';
 import { createAudit } from './audit.js';
 import { startBroker } from './broker.js';
-import { assertKeysReadable, assertUserTokensReadable, loadConfig, resolveConfigPath } from './config.js';
+import { assertKeysReadable, assertUserTokensReadable, loadConfigText, readConfigText, resolveConfigPath } from './config.js';
 import { createProvider } from './providers/index.js';
+import { ConfigWatcher } from './reload.js';
 /** Usage text. */
 const USAGE = 'usage: gcb daemon [--config <path>] [--check]\n' +
     '       --config defaults to $GIT_BROKER_CONFIG, then ./broker.config.yml\n' +
@@ -70,15 +81,22 @@ export async function runDaemon(argv, io = {}) {
     // Same convention as the management commands: --config, else GIT_BROKER_CONFIG, else
     // ./broker.config.yml. A wrong pick is loud, because it must load and validate to start at all.
     const resolved = resolveConfigPath(configPath);
+    const load = () => {
+        const text = readConfigText(resolved);
+        const next = loadConfigText(text, resolved);
+        assertKeysReadable(next);
+        assertUserTokensReadable(next);
+        return {
+            config: next,
+            providers: buildProviders(next, { log: (message) => stderr.write(`gcb daemon: ${message}\n`) }),
+            digest: createHash('sha256').update(text).digest('hex'),
+        };
+    };
     let config;
     let providers;
+    let initialDigest;
     try {
-        config = loadConfig(resolved);
-        assertKeysReadable(config);
-        assertUserTokensReadable(config);
-        providers = buildProviders(config, {
-            log: (message) => stderr.write(`gcb daemon: ${message}\n`),
-        });
+        ({ config, providers, digest: initialDigest } = load());
     }
     catch (error) {
         stderr.write(`gcb daemon: ${error.message}\n`);
@@ -107,16 +125,48 @@ export async function runDaemon(argv, io = {}) {
         stderr.write(`gcb daemon: cannot start: ${error.message}\n`);
         return 1;
     }
+    const active = { config, providers };
+    const watcher = new ConfigWatcher({
+        file: resolved,
+        initialDigest,
+        reload: () => {
+            const next = load();
+            if (next.config.socketPath !== active.config.socketPath) {
+                throw new Error('socketPath cannot change without restarting the broker');
+            }
+            if (next.config.socketMode !== active.config.socketMode) {
+                throw new Error('socketMode cannot change without restarting the broker');
+            }
+            if (next.config.auditPath !== active.config.auditPath) {
+                throw new Error('auditPath cannot change without restarting the broker');
+            }
+            broker.reload(next.config, next.providers);
+            active.config = next.config;
+            active.providers = next.providers;
+            stderr.write(`gcb daemon: config reloaded\n`);
+            audit.record({ event: 'config', decision: 'reload' });
+            return next.digest;
+        },
+        onError: (error) => {
+            stderr.write(`gcb daemon: config reload failed: ${error.message}\n`);
+            audit.record({ event: 'config', decision: 'reload-failed', reason: error.message });
+        },
+    });
+    watcher.start();
     await new Promise((resolve) => {
         const shutdown = (signal) => {
             stderr.write(`gcb daemon: ${signal} received, shutting down\n`);
+            watcher.stop();
+            process.off('SIGHUP', onHup);
             broker
                 .close()
                 .then(() => audit.close())
                 .then(() => resolve());
         };
+        const onHup = () => watcher.check(true);
         process.once('SIGTERM', () => shutdown('SIGTERM'));
         process.once('SIGINT', () => shutdown('SIGINT'));
+        process.on('SIGHUP', onHup);
     });
     return 0;
 }

package/lib/daemon.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,kBAAkB;AAClB,MAAM,KAAK,GACT,iDAAiD;IACjD,4EAA4E;IAC5E,+FAA+F,CAAC;AASlG;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,IAAI,UAA8B,CAAC;IACnC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,IAAI,GAAiB,EAAE;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,SAAS,CAAC,GAAG,CACX,IAAI,EACJ,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;YAC1B,GAAG,IAAI;YACP,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,qBAAqB;SAC9D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAuB,EACvB,EAAE,GAA6C,EAAE;IAEjD,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IAChE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,qFAAqF;IACrF,gGAAgG;IAChG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,MAAoB,CAAC;IACzB,IAAI,SAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACjC,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE;YACjC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACpD,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC;IAC1F,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,CAAC,KAAK,CAAC,sBAAsB,QAAQ,QAAQ,OAAO,IAAI,CAAC,CAAC;IAEhE,IAAI,SAAS;QAAE,OAAO,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,IAAI,MAA+C,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC;YACzB,MAAM;YACN,KAAK;YACL,SAAS;YACT,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,6BAA8B,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,4BAA4B,CAAC,CAAC;YAChE,MAAM;iBACH,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;iBACzB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9H,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,kBAAkB;AAClB,MAAM,KAAK,GACT,iDAAiD;IACjD,4EAA4E;IAC5E,+FAA+F,CAAC;AASlG;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,IAAI,UAA8B,CAAC;IACnC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,IAAI,GAAiB,EAAE;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,SAAS,CAAC,GAAG,CACX,IAAI,EACJ,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;YAC1B,GAAG,IAAI;YACP,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,qBAAqB;SAC9D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAuB,EACvB,EAAE,GAA6C,EAAE;IAEjD,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IAChE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,qFAAqF;IACrF,gGAAgG;IAChG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE/C,MAAM,IAAI,GAAG,GAA+E,EAAE;QAC5F,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/F,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACxD,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,MAAoB,CAAC;IACzB,IAAI,SAAgC,CAAC;IACrC,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACpD,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC;IAC1F,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,CAAC,KAAK,CAAC,sBAAsB,QAAQ,QAAQ,OAAO,IAAI,CAAC,CAAC;IAEhE,IAAI,SAAS;QAAE,OAAO,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,IAAI,MAA+C,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC;YACzB,MAAM;YACN,KAAK;YACL,SAAS;YACT,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,6BAA8B,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,IAAI,EAAE,QAAQ;QACd,aAAa;QACb,MAAM,EAAE,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;YACpB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,KAAK,CAAC,qCAAqC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,4BAA4B,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM;iBACH,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;iBACzB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/lib/device-flow.d.ts

@@ -15,6 +15,7 @@ export type Fetcher = (url: string, init: {
     method: string;
     headers: Record<string, string>;
     body: string;
+    signal?: AbortSignal;
 }) => Promise<{
     ok: boolean;
     status: number;

package/lib/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,yDAAyD;AACzD,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEvE,sCAAsC;AACtC,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElD,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,yCAAyC,CAAC;AACtE,eAAO,MAAM,SAAS,gDAAgD,CAAC;AACvE,sEAAsE;AACtE,eAAO,MAAM,YAAY,iDAAiD,CAAC;AAmB3E;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CA4B7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,SAAS,CAAC,CAwCpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAyBpB"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,yDAAyD;AACzD,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAC1F,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEvE,sCAAsC;AACtC,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElD,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,yCAAyC,CAAC;AACtE,eAAO,MAAM,SAAS,gDAAgD,CAAC;AACvE,sEAAsE;AACtE,eAAO,MAAM,YAAY,iDAAiD,CAAC;AAmB3E;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CA4B7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,SAAS,CAAC,CAwCpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CA0BpB"}

package/lib/device-flow.js

@@ -133,6 +133,7 @@ export async function refreshUserToken(clientId, refreshToken, fetcher) {
             grant_type: 'refresh_token',
             refresh_token: refreshToken,
         }).toString(),
+        signal: AbortSignal.timeout(30_000),
     });
     const text = await response.text();
     const parsed = parseJson(text);

package/lib/device-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA8BH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AACtE,MAAM,CAAC,MAAM,SAAS,GAAG,6CAA6C,CAAC;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AACD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAgB;IACtE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI;KACL,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,gCAAgC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAM5B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,WAAW;QAC9B,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,SAAS,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,IAAgB,EAChB,OAAgB,EAChB,KAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC7B,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,IAAI,CAAC,UAAU;gBAC5B,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAK5B,CAAC;QAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU;aACpC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACvD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAK5B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY;QAClD,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA8BH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AACtE,MAAM,CAAC,MAAM,SAAS,GAAG,6CAA6C,CAAC;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AACD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAgB;IACtE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI;KACL,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,gCAAgC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAM5B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,WAAW;QAC9B,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,SAAS,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,IAAgB,EAChB,OAAgB,EAChB,KAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC7B,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,IAAI,CAAC,UAAU;gBAC5B,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAK5B,CAAC;QAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU;aACpC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACvD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC,QAAQ,EAAE;QACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAK5B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY;QAClD,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC"}

package/lib/providers/github-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../src/providers/github-app.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAc,SAAS,EAAqB,mBAAmB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBxG,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAuB7D;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,CA+8BnF"}
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../src/providers/github-app.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAc,SAAS,EAAqB,mBAAmB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBxG,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAuB7D;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,CAo+BnF"}

package/lib/providers/github-app.js

@@ -390,6 +390,90 @@ export function createGithubAppProvider(options) {
     // the exchange even when the commands selected different proxy routes, then let the waiter re-read
     // the cache the winner wrote. Each exchange still uses its own command's fetch.
     let renewingPersonToken;
+    /**
+     * The token of the person this deployment authorized, when there is one.
+     *
+     * Only person-relevant actions may use it; GitHub will not author a pull request as a person for
+     * an app, refuses to resolve a review thread for one, and a reply must be attributable to the
+     * person answering.
+     * The refresh token lives beside the private key, and GitHub rotates it on every use, so the new
+     * one is written back — keeping the old would work once and then stop.
+     *
+     * @returns the user token, or `undefined` when nobody has authorized one.
+     */
+    async function personalToken() {
+        while (renewingPersonToken !== undefined) {
+            try {
+                await renewingPersonToken;
+            }
+            catch {
+                // The winner failed; this command retries after the lock is released.
+            }
+        }
+        const pending = renewPersonToken();
+        renewingPersonToken = pending;
+        try {
+            return await pending;
+        }
+        finally {
+            if (renewingPersonToken === pending)
+                renewingPersonToken = undefined;
+        }
+    }
+    /** The authorized person's token, falling back to the per-owner token for this owner. */
+    async function personTokenFor(owner) {
+        const personal = await personalToken();
+        if (personal !== undefined)
+            return personal;
+        const file = cfg.userTokens?.[owner];
+        if (file === undefined)
+            return undefined;
+        const token = readFileSync(file, 'utf8').trim();
+        return token === '' ? undefined : token;
+    }
+    async function renewPersonToken() {
+        if (cfg.clientId === undefined || cfg.privateKeyPath === undefined)
+            return undefined;
+        const path = userTokenPath(cfg.privateKeyPath);
+        if (!existsSync(path))
+            return undefined;
+        const now = Date.now();
+        // The file is the only thing that says who the broker may act as, so it is read before the cache is
+        // trusted: running `authorize` again — the documented way to change that person, and the only one —
+        // has to take effect now rather than when the cached token happens to expire.
+        const held = readFileSync(path, 'utf8').trim();
+        if (cachedPersonToken !== undefined &&
+            cachedPersonToken.until > now + 60_000 &&
+            cachedPersonToken.source === held) {
+            return cachedPersonToken.token;
+        }
+        let next;
+        try {
+            next = await refreshUserToken(cfg.clientId, held, (url, init) => fetchImpl(url, init));
+        }
+        catch (error) {
+            // This is the one place a renewal failure is explained: the caller is an action that failed,
+            // and "fetch failed" on its own names neither the host nor the reason.
+            throw new Error(`could not renew the authorized token from ${path}: ${error.message}${describeCause(error)}`);
+        }
+        if (next.refreshToken !== undefined) {
+            try {
+                writeFileSync(path, `${next.refreshToken}\n`, { mode: 0o600 });
+            }
+            catch (error) {
+                // GitHub invalidated the token on disk the moment it answered, so this is not transient and not
+                // recoverable: the next renewal reads a dead token. Nothing else in the log would say so.
+                throw new Error(`could not store the new refresh token in ${path}: ${error.message}; the previous ` +
+                    'one is no longer valid, so run authorize again');
+            }
+        }
+        cachedPersonToken = {
+            token: next.token,
+            until: now + (next.expiresInSeconds ?? 28_800) * 1_000,
+            source: next.refreshToken ?? held,
+        };
+        return cachedPersonToken.token;
+    }
     /**
      * One more sentence about a failure, when there is one worth having.
      *
@@ -426,16 +510,30 @@ export function createGithubAppProvider(options) {
         name: 'github-app',
         async runAction(request) {
             const spec = getGhAction(request.action);
-            const wanted = { ...spec.permissions };
-            await ensurePermissions(request.owner, wanted);
-            const installationId = await resolveInstallationId(request.owner);
-            const { json } = await call('POST', `${api}/app/installations/${installationId}/access_tokens`, {
-                repositories: [request.repo],
-                permissions: wanted,
-            });
-            const token = json?.token;
-            if (typeof token !== 'string' || !token) {
-                throw new ProviderConfigError('GitHub returned no installation token for the action');
+            const identity = request.identity ?? 'app';
+            let token;
+            let minted = false;
+            if (identity === 'user') {
+                const person = await personTokenFor(request.owner);
+                if (person === undefined) {
+                    throw new ProviderConfigError('no authorized user token for this action; run gcb authorize or configure userTokens');
+                }
+                token = person;
+            }
+            else {
+                const wanted = { ...spec.permissions };
+                await ensurePermissions(request.owner, wanted);
+                const installationId = await resolveInstallationId(request.owner);
+                const { json } = await call('POST', `${api}/app/installations/${installationId}/access_tokens`, {
+                    repositories: [request.repo],
+                    permissions: wanted,
+                });
+                const mintedToken = json?.token;
+                if (typeof mintedToken !== 'string' || !mintedToken) {
+                    throw new ProviderConfigError('GitHub returned no installation token for the action');
+                }
+                token = mintedToken;
+                minted = true;
             }
             let result;
             let warning;
@@ -455,32 +553,34 @@ export function createGithubAppProvider(options) {
                 result = { ...NO_RUN, error: error instanceof Error ? error.message : String(error) };
             }
             finally {
-                try {
-                    const response = await fetchImpl(`${api}/installation/token`, {
-                        method: 'DELETE',
-                        headers: {
-                            accept: 'application/vnd.github+json',
-                            authorization: `Bearer ${token}`,
-                            'x-github-api-version': apiVersion,
-                            'user-agent': 'gcb',
-                        },
-                    });
-                    if (!response.ok) {
-                        let detail = '';
-                        try {
-                            detail = (await response.text()).replace(/\s+/g, ' ').trim().slice(0, 200);
-                        }
-                        catch {
-                            // The status is enough; a body that cannot be read is still not a successful revoke.
+                if (minted) {
+                    try {
+                        const response = await fetchImpl(`${api}/installation/token`, {
+                            method: 'DELETE',
+                            headers: {
+                                accept: 'application/vnd.github+json',
+                                authorization: `Bearer ${token}`,
+                                'x-github-api-version': apiVersion,
+                                'user-agent': 'gcb',
+                            },
+                        });
+                        if (!response.ok) {
+                            let detail = '';
+                            try {
+                                detail = (await response.text()).replace(/\s+/g, ' ').trim().slice(0, 200);
+                            }
+                            catch {
+                                // The status is enough; a body that cannot be read is still not a successful revoke.
+                            }
+                            log(`could not revoke the action token: GitHub answered ${response.status}${detail ? ` ${detail}` : ''}`);
+                            warning = REVOKE_WARNING;
                         }
-                        log(`could not revoke the action token: GitHub answered ${response.status}${detail ? ` ${detail}` : ''}`);
+                    }
+                    catch (error) {
+                        log(`could not revoke the action token: ${String(error.message ?? error)}`);
                         warning = REVOKE_WARNING;
                     }
                 }
-                catch (error) {
-                    log(`could not revoke the action token: ${String(error.message ?? error)}`);
-                    warning = REVOKE_WARNING;
-                }
             }
             return { ...result, tokenFingerprint: tokenFingerprint(token), ...(warning === undefined ? {} : { warning }) };
         },
@@ -559,11 +659,7 @@ export function createGithubAppProvider(options) {
          */
         async pullRequest(request) {
             if (request.action === 'fork') {
-                let token = await personalToken();
-                const userToken = cfg.userTokens?.[request.owner];
-                if (token === undefined && userToken !== undefined) {
-                    token = readFileSync(userToken, 'utf8').trim();
-                }
+                const token = await personTokenFor(request.owner);
                 if (token === undefined) {
                     throw new ProviderConfigError('no user token for fork; run gcb authorize or configure userTokens');
                 }
@@ -581,28 +677,26 @@ export function createGithubAppProvider(options) {
                 }
                 return { number: 0, url: forked.html_url };
             }
-            // The two actions a person may perform are decided first: when somebody has authorized this
-            // deployment, their token is the whole authority for them, and requiring an installation as well
-            // would refuse a repository the app was never installed on — the fork-to-upstream case the allowlist
-            // exists to permit. Everything else still acts as the app, and only ever could.
+            // The person is selected explicitly, and by default for the two operations an installation token
+            // cannot perform (open/resolve): requiring an installation as well would refuse a repository the
+            // app was never installed on — the fork-to-upstream case the allowlist exists to permit. Reply,
+            // edit and comment stay on the app unless identity is explicitly 'user'.
             const wantsApp = request.identity === 'app';
-            const wantsUser = request.identity === 'user';
-            const personalForThis = !wantsApp && (request.action === 'open' || request.action === 'resolve');
-            const personToken = personalForThis ? await personalToken() : undefined;
+            const personalForThis = request.identity === 'user' ||
+                (!wantsApp && (request.action === 'open' || request.action === 'resolve'));
+            const actingToken = personalForThis ? await personTokenFor(request.owner) : undefined;
+            // Resolving has no app route: the thread mutation is refused for an installation token, so a
+            // missing person token is a configuration error, not a reason to mint the wrong credential.
+            const personRequired = request.identity === 'user' || request.action === 'resolve';
+            if (personRequired && actingToken === undefined) {
+                throw new ProviderConfigError(`no authorized user token for ${request.action === 'resolve' ? 'resolving this thread' : 'this request'}; run gcb authorize or configure userTokens`);
+            }
             // `--status` also reads /actions/runs, which is checked against actions: read. Pre-flighting
             // pull_requests alone passed a grant that could not make that call, which is the opposite of what a
             // pre-flight is for.
             const wanted = request.action === 'status' ? { ...PULL_REQUEST_PERMISSIONS, actions: 'read' } : PULL_REQUEST_PERMISSIONS;
             // One variable, so every branch below holds a token without having to ask which kind it is.
             let token;
-            // A token per owner is the other way a person acts. It counts exactly as the authorized token does:
-            // whoever is acting, requiring an installation as well would refuse a repository the app was never
-            // installed on — the fork-to-upstream case the allowlist exists to permit.
-            const fileToken = personalForThis ? cfg.userTokens?.[request.owner] : undefined;
-            const actingToken = personToken ?? (fileToken === undefined ? undefined : readFileSync(fileToken, 'utf8').trim());
-            if (wantsUser && actingToken === undefined) {
-                throw new ProviderConfigError('no authorized user token for this request; run gcb authorize or configure userTokens');
-            }
             if (actingToken === undefined) {
                 await ensurePermissions(request.owner, wanted);
                 const installationId = await resolveInstallationId(request.owner);
@@ -620,84 +714,12 @@ export function createGithubAppProvider(options) {
                 token = actingToken;
             }
             const collection = `${api}/repos/${request.owner}/${request.repo}/pulls`;
-            /**
-             * The token of the person this deployment authorized, when there is one.
-      
-             * Only two actions may use it, and both because an installation token cannot: GitHub will not
-             * author a pull request as a person for an app, and refuses to resolve a review thread for one.
-             * The refresh token lives beside the private key, and GitHub rotates it on every use, so the new
-             * one is written back — keeping the old would work once and then stop.
-             *
-             * @returns the user token, or `undefined` when nobody has authorized one.
-             */
-            async function personalToken() {
-                while (renewingPersonToken !== undefined) {
-                    try {
-                        await renewingPersonToken;
-                    }
-                    catch {
-                        // The winner failed; this command retries after the lock is released.
-                    }
-                }
-                const pending = renewPersonToken();
-                renewingPersonToken = pending;
-                try {
-                    return await pending;
-                }
-                finally {
-                    if (renewingPersonToken === pending)
-                        renewingPersonToken = undefined;
-                }
-            }
-            async function renewPersonToken() {
-                if (cfg.clientId === undefined || cfg.privateKeyPath === undefined)
-                    return undefined;
-                const path = userTokenPath(cfg.privateKeyPath);
-                if (!existsSync(path))
-                    return undefined;
-                const now = Date.now();
-                // The file is the only thing that says who the broker may act as, so it is read before the cache is
-                // trusted: running `authorize` again — the documented way to change that person, and the only one —
-                // has to take effect now rather than when the cached token happens to expire.
-                const held = readFileSync(path, 'utf8').trim();
-                if (cachedPersonToken !== undefined &&
-                    cachedPersonToken.until > now + 60_000 &&
-                    cachedPersonToken.source === held) {
-                    return cachedPersonToken.token;
-                }
-                let next;
-                try {
-                    next = await refreshUserToken(cfg.clientId, held, (url, init) => fetchImpl(url, init));
-                }
-                catch (error) {
-                    // This is the one place a renewal failure is explained: the caller is an action that failed,
-                    // and "fetch failed" on its own names neither the host nor the reason.
-                    throw new Error(`could not renew the authorized token from ${path}: ${error.message}${describeCause(error)}`);
-                }
-                if (next.refreshToken !== undefined) {
-                    try {
-                        writeFileSync(path, `${next.refreshToken}\n`, { mode: 0o600 });
-                    }
-                    catch (error) {
-                        // GitHub invalidated the token on disk the moment it answered, so this is not transient and not
-                        // recoverable: the next renewal reads a dead token. Nothing else in the log would say so.
-                        throw new Error(`could not store the new refresh token in ${path}: ${error.message}; the previous ` +
-                            'one is no longer valid, so run authorize again');
-                    }
-                }
-                cachedPersonToken = {
-                    token: next.token,
-                    until: now + (next.expiresInSeconds ?? 28_800) * 1_000,
-                    source: next.refreshToken ?? held,
-                };
-                return cachedPersonToken.token;
-            }
             if (request.action === 'resolve') {
                 // Resolving has no REST endpoint either. The thread id is the one `--threads` prints.
                 // The thread id is a global node id, and the person token is not narrowed to a repository the way
                 // an installation token is. Ask whose thread it is before changing it: the allowlist decided which
                 // repositories this broker may touch, and a mutation is the wrong place to discover it did not.
-                const { text: scoped } = await callWithToken('POST', `${api}/graphql`, personToken ?? token, {
+                const { text: scoped } = await callWithToken('POST', `${api}/graphql`, token, {
                     query: 'query($threadId:ID!){node(id:$threadId){... on PullRequestReviewThread{pullRequest{repository{nameWithOwner}}}}}',
                     variables: { threadId: request.threadId },
                 });
@@ -715,7 +737,7 @@ export function createGithubAppProvider(options) {
                     throw new Error(`refusing to resolve ${request.threadId}: it is not a review thread of ${request.owner}/${request.repo}` +
                         (typeof belongsTo === 'string' ? ` (it belongs to ${belongsTo})` : ' (or it could not be read)'));
                 }
-                const { text: raw } = await callWithToken('POST', `${api}/graphql`, personToken ?? token, {
+                const { text: raw } = await callWithToken('POST', `${api}/graphql`, token, {
                     query: 'mutation($threadId:ID!){resolveReviewThread(input:{threadId:$threadId}){thread{isResolved}}}',
                     variables: { threadId: request.threadId ?? '' },
                 });