reflectt-node 0.1.0

package/dist/format-duration.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Duration formatting utilities.
+ *
+ * Centralises ms→minutes/hours/days conversion so every call site
+ * goes through the same, tested path.  Prevents the class of bug
+ * where one location divides by 60 instead of 60_000.
+ */
+/** Convert milliseconds to whole minutes (rounded). */
+export declare function msToMinutes(ms: number): number;
+/**
+ * Human-readable duration string from milliseconds.
+ *
+ *   formatDuration(90_000)       → "2m"
+ *   formatDuration(7_200_000)    → "2h 0m"
+ *   formatDuration(90_000_000)   → "1d 1h"
+ *   formatDuration(32_081_400)   → "8h 55m"   (the 534,690m bug scenario)
+ */
+export declare function formatDuration(ms: number): string;
+//# sourceMappingURL=format-duration.d.ts.map

package/dist/format-duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-duration.d.ts","sourceRoot":"","sources":["../src/format-duration.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,uDAAuD;AACvD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CASjD"}

package/dist/format-duration.js

@@ -0,0 +1,33 @@
+/**
+ * Duration formatting utilities.
+ *
+ * Centralises ms→minutes/hours/days conversion so every call site
+ * goes through the same, tested path.  Prevents the class of bug
+ * where one location divides by 60 instead of 60_000.
+ */
+/** Convert milliseconds to whole minutes (rounded). */
+export function msToMinutes(ms) {
+    return Math.round(ms / 60_000);
+}
+/**
+ * Human-readable duration string from milliseconds.
+ *
+ *   formatDuration(90_000)       → "2m"
+ *   formatDuration(7_200_000)    → "2h 0m"
+ *   formatDuration(90_000_000)   → "1d 1h"
+ *   formatDuration(32_081_400)   → "8h 55m"   (the 534,690m bug scenario)
+ */
+export function formatDuration(ms) {
+    if (ms < 0)
+        return '0m';
+    const totalMin = Math.floor(ms / 60_000);
+    if (totalMin < 60)
+        return `${totalMin}m`;
+    const h = Math.floor(totalMin / 60);
+    const m = totalMin % 60;
+    if (h < 24)
+        return `${h}h ${m}m`;
+    const d = Math.floor(h / 24);
+    return `${d}d ${h % 24}h`;
+}
+//# sourceMappingURL=format-duration.js.map

package/dist/format-duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-duration.js","sourceRoot":"","sources":["../src/format-duration.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;IACxC,IAAI,QAAQ,GAAG,EAAE;QAAE,OAAO,GAAG,QAAQ,GAAG,CAAA;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAA;IACnC,MAAM,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAA;IACvB,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAA;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAA;AAC3B,CAAC"}

package/dist/github-actor-auth.d.ts

@@ -0,0 +1,20 @@
+import type { SecretVault } from './secrets.js';
+export declare function initGitHubActorAuth(vault: SecretVault): void;
+export interface GitHubActorTokenResult {
+    token: string;
+    source: 'vault' | 'env';
+    secretName?: string;
+    envKey?: string;
+}
+/**
+ * Resolve a GitHub token for a given actor.
+ *
+ * Resolution order:
+ *  1) SecretVault: `github.pat.<actor>` (recommended)
+ *  2) SecretVault: `github.pat.reviewer` (fallback shared reviewer/bot identity)
+ *  3) Environment: `GH_TOKEN_<ACTOR>` / `GITHUB_TOKEN_<ACTOR>` (optional)
+ *  4) Environment: `GH_TOKEN` / `GITHUB_TOKEN` (legacy)
+ */
+export declare function resolveGitHubTokenForActor(actor: string): GitHubActorTokenResult | null;
+export declare function buildGhEnvWithToken(token: string): NodeJS.ProcessEnv;
+//# sourceMappingURL=github-actor-auth.d.ts.map

package/dist/github-actor-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actor-auth.d.ts","sourceRoot":"","sources":["../src/github-actor-auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAI/C,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAE5D;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,OAAO,GAAG,KAAK,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CA8BvF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAOpE"}

package/dist/github-actor-auth.js

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+// GitHub per-actor token resolution + safe helpers.
+let vaultRef = null;
+export function initGitHubActorAuth(vault) {
+    vaultRef = vault;
+}
+/**
+ * Resolve a GitHub token for a given actor.
+ *
+ * Resolution order:
+ *  1) SecretVault: `github.pat.<actor>` (recommended)
+ *  2) SecretVault: `github.pat.reviewer` (fallback shared reviewer/bot identity)
+ *  3) Environment: `GH_TOKEN_<ACTOR>` / `GITHUB_TOKEN_<ACTOR>` (optional)
+ *  4) Environment: `GH_TOKEN` / `GITHUB_TOKEN` (legacy)
+ */
+export function resolveGitHubTokenForActor(actor) {
+    const a = (actor || '').trim();
+    const actorKey = a || 'unknown';
+    // Vault secrets (preferred)
+    if (vaultRef) {
+        const byActor = `github.pat.${actorKey}`;
+        const v1 = vaultRef.read(byActor, `github-actor-auth:${actorKey}`);
+        if (v1 && v1.trim())
+            return { token: v1.trim(), source: 'vault', secretName: byActor };
+        const reviewer = 'github.pat.reviewer';
+        const v2 = vaultRef.read(reviewer, `github-actor-auth:${actorKey}`);
+        if (v2 && v2.trim())
+            return { token: v2.trim(), source: 'vault', secretName: reviewer };
+    }
+    // Env overrides per actor
+    const upper = actorKey.toUpperCase().replace(/[^A-Z0-9]/g, '_');
+    const actorEnvKeys = [`GH_TOKEN_${upper}`, `GITHUB_TOKEN_${upper}`];
+    for (const k of actorEnvKeys) {
+        const v = process.env[k];
+        if (v && v.trim())
+            return { token: v.trim(), source: 'env', envKey: k };
+    }
+    // Legacy env
+    for (const k of ['GH_TOKEN', 'GITHUB_TOKEN']) {
+        const v = process.env[k];
+        if (v && v.trim())
+            return { token: v.trim(), source: 'env', envKey: k };
+    }
+    return null;
+}
+export function buildGhEnvWithToken(token) {
+    // gh CLI uses GH_TOKEN; some libs read GITHUB_TOKEN.
+    return {
+        ...process.env,
+        GH_TOKEN: token,
+        GITHUB_TOKEN: token,
+    };
+}
+//# sourceMappingURL=github-actor-auth.js.map

package/dist/github-actor-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actor-auth.js","sourceRoot":"","sources":["../src/github-actor-auth.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,oDAAoD;AAIpD,IAAI,QAAQ,GAAuB,IAAI,CAAA;AAEvC,MAAM,UAAU,mBAAmB,CAAC,KAAkB;IACpD,QAAQ,GAAG,KAAK,CAAA;AAClB,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9B,MAAM,QAAQ,GAAG,CAAC,IAAI,SAAS,CAAA;IAE/B,4BAA4B;IAC5B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,cAAc,QAAQ,EAAE,CAAA;QACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,QAAQ,EAAE,CAAC,CAAA;QAClE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;QAEtF,MAAM,QAAQ,GAAG,qBAAqB,CAAA;QACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,QAAQ,EAAE,CAAC,CAAA;QACnE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;IACzF,CAAC;IAED,0BAA0B;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,gBAAgB,KAAK,EAAE,CAAC,CAAA;IACnE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACzE,CAAC;IAED,aAAa;IACb,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACzE,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qDAAqD;IACrD,OAAO;QACL,GAAG,OAAO,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAA;AACH,CAAC"}

package/dist/github-ci.d.ts

@@ -0,0 +1,16 @@
+export type GitHubCiState = 'success' | 'failure' | 'pending' | 'error' | 'unknown';
+export type GitHubCiSource = 'github-check-runs' | 'github-status' | 'unavailable';
+type CheckRun = {
+    status?: string;
+    conclusion?: string | null;
+};
+export declare function computeCiFromCheckRuns(checkRuns: CheckRun[]): {
+    state: GitHubCiState;
+    details?: string;
+};
+export declare function computeCiFromCombinedStatus(state: unknown): {
+    state: GitHubCiState;
+    details?: string;
+};
+export {};
+//# sourceMappingURL=github-ci.d.ts.map

package/dist/github-ci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-ci.d.ts","sourceRoot":"","sources":["../src/github-ci.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;AAEnF,MAAM,MAAM,cAAc,GAAG,mBAAmB,GAAG,eAAe,GAAG,aAAa,CAAA;AAElF,KAAK,QAAQ,GAAG;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,CAAA;AAWD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBxG;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAMtG"}

package/dist/github-ci.js

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: Apache-2.0
+const SUCCESS_CONCLUSIONS = new Set(['success', 'neutral', 'skipped']);
+const FAILURE_CONCLUSIONS = new Set([
+    'failure',
+    'cancelled',
+    'timed_out',
+    'action_required',
+    'stale',
+]);
+export function computeCiFromCheckRuns(checkRuns) {
+    if (!Array.isArray(checkRuns) || checkRuns.length === 0) {
+        return { state: 'unknown', details: 'No check-runs returned' };
+    }
+    const statuses = checkRuns.map(r => String(r.status || '').toLowerCase());
+    const conclusions = checkRuns.map(r => (r.conclusion === null || r.conclusion === undefined) ? '' : String(r.conclusion).toLowerCase());
+    // If anything is not completed, CI is still pending.
+    if (statuses.some(s => s !== 'completed')) {
+        return { state: 'pending', details: 'Some check-runs are not completed' };
+    }
+    // Completed, but any failing conclusion means failure.
+    if (conclusions.some(c => FAILURE_CONCLUSIONS.has(c))) {
+        return { state: 'failure', details: 'At least one check-run concluded non-success' };
+    }
+    // If all completed runs are success-ish, CI is success.
+    if (conclusions.every(c => SUCCESS_CONCLUSIONS.has(c))) {
+        return { state: 'success' };
+    }
+    return { state: 'unknown', details: 'Unrecognized check-run conclusion mix' };
+}
+export function computeCiFromCombinedStatus(state) {
+    const normalized = typeof state === 'string' ? state.toLowerCase() : 'unknown';
+    if (normalized === 'success' || normalized === 'failure' || normalized === 'pending' || normalized === 'error') {
+        return { state: normalized };
+    }
+    return { state: 'unknown', details: 'Unknown combined status state' };
+}
+//# sourceMappingURL=github-ci.js.map

package/dist/github-ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-ci.js","sourceRoot":"","sources":["../src/github-ci.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAWtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AACtE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS;IACT,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,UAAU,sBAAsB,CAAC,SAAqB;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACzE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAEvI,qDAAqD;IACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;IAC3E,CAAC;IAED,uDAAuD;IACvD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAA;IACtF,CAAC;IAED,wDAAwD;IACxD,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC7B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9E,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC/G,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAA;AACvE,CAAC"}

package/dist/github-identity.d.ts

@@ -0,0 +1,30 @@
+import type { SecretVault } from './secrets.js';
+export type GitHubIdentityMode = 'pat' | 'app_installation';
+export interface GitHubIdentityConfig {
+    mode: GitHubIdentityMode;
+    /** Only used for PAT mode (optional). If unset we fall back to env vars. */
+    patEnvKeys?: string[];
+    /** Vault secret names for App mode. */
+    app?: {
+        /** PEM private key for GitHub App (PKCS#1 or PKCS#8). */
+        privateKeySecretName: string;
+        /** GitHub App ID (not client id). */
+        appIdSecretName: string;
+        /** GitHub App installation ID to mint tokens for. */
+        installationIdSecretName: string;
+    };
+}
+export interface GitHubIdentityProvider {
+    /** Returns an OAuth token suitable for `Authorization: Bearer <token>` */
+    getToken(): Promise<{
+        token: string;
+        source: 'pat' | 'app_installation';
+    } | null>;
+    getMode(): GitHubIdentityMode;
+}
+export declare function createGitHubIdentityProvider(opts: {
+    config: GitHubIdentityConfig;
+    vault?: SecretVault;
+    fetchImpl?: typeof fetch;
+}): GitHubIdentityProvider;
+//# sourceMappingURL=github-identity.d.ts.map

package/dist/github-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-identity.d.ts","sourceRoot":"","sources":["../src/github-identity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG/C,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,kBAAkB,CAAA;AAE3D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAA;IACxB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,uCAAuC;IACvC,GAAG,CAAC,EAAE;QACJ,yDAAyD;QACzD,oBAAoB,EAAE,MAAM,CAAA;QAC5B,qCAAqC;QACrC,eAAe,EAAE,MAAM,CAAA;QACvB,qDAAqD;QACrD,wBAAwB,EAAE,MAAM,CAAA;KACjC,CAAA;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,QAAQ,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,GAAG,kBAAkB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IACjF,OAAO,IAAI,kBAAkB,CAAA;CAC9B;AAuCD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,oBAAoB,CAAA;IAC5B,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,GAAG,sBAAsB,CA4EzB"}

package/dist/github-identity.js

@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: Apache-2.0
+// GitHub Identity Provider — supports PAT fallback and GitHub App installation tokens.
+import { createSign } from 'node:crypto';
+function readEnvToken(keys) {
+    for (const k of keys) {
+        const v = process.env[k];
+        if (v && v.trim())
+            return v.trim();
+    }
+    return null;
+}
+function base64Url(input) {
+    const buf = Buffer.isBuffer(input) ? input : Buffer.from(input);
+    return buf
+        .toString('base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+}
+function signJwtRS256(payload, privateKeyPem) {
+    const header = { alg: 'RS256', typ: 'JWT' };
+    const headerPart = base64Url(JSON.stringify(header));
+    const payloadPart = base64Url(JSON.stringify(payload));
+    const toSign = `${headerPart}.${payloadPart}`;
+    const signer = createSign('RSA-SHA256');
+    signer.update(toSign);
+    signer.end();
+    const signature = signer.sign(privateKeyPem);
+    return `${toSign}.${base64Url(signature)}`;
+}
+export function createGitHubIdentityProvider(opts) {
+    const config = opts.config;
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const patEnvKeys = config.patEnvKeys ?? ['GITHUB_TOKEN', 'GH_TOKEN'];
+    let cached = null;
+    async function getAppInstallationToken() {
+        if (!opts.vault)
+            return null;
+        if (!config.app)
+            return null;
+        const privateKey = opts.vault.read(config.app.privateKeySecretName, 'github-identity');
+        const appId = opts.vault.read(config.app.appIdSecretName, 'github-identity');
+        const installationId = opts.vault.read(config.app.installationIdSecretName, 'github-identity');
+        if (!privateKey || !appId || !installationId)
+            return null;
+        // Return cached token if still valid with 60s buffer.
+        const now = Date.now();
+        if (cached && cached.expiresAt - 60_000 > now)
+            return cached.token;
+        const iat = Math.floor(now / 1000) - 30;
+        const exp = iat + 9 * 60; // 9m (GitHub max is 10m for app JWT)
+        const jwt = signJwtRS256({
+            iat,
+            exp,
+            iss: Number(appId),
+        }, privateKey);
+        const res = await fetchImpl(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
+            method: 'POST',
+            headers: {
+                Accept: 'application/vnd.github+json',
+                Authorization: `Bearer ${jwt}`,
+                'X-GitHub-Api-Version': '2022-11-28',
+            },
+        });
+        if (!res.ok)
+            return null;
+        const json = (await res.json());
+        const token = typeof json?.token === 'string' ? json.token : null;
+        const expiresAtIso = typeof json?.expires_at === 'string' ? json.expires_at : null;
+        if (!token || !expiresAtIso)
+            return null;
+        const expiresAt = Date.parse(expiresAtIso);
+        if (!Number.isFinite(expiresAt))
+            return null;
+        cached = { token, expiresAt };
+        return token;
+    }
+    return {
+        getMode() {
+            return config.mode;
+        },
+        async getToken() {
+            if (config.mode === 'app_installation') {
+                const token = await getAppInstallationToken();
+                if (token)
+                    return { token, source: 'app_installation' };
+                // fall back to PAT env if app mode misconfigured
+            }
+            const pat = readEnvToken(patEnvKeys);
+            if (pat)
+                return { token: pat, source: 'pat' };
+            return null;
+        },
+    };
+}
+//# sourceMappingURL=github-identity.js.map

package/dist/github-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-identity.js","sourceRoot":"","sources":["../src/github-identity.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,uFAAuF;AAGvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AA+BxC,SAAS,YAAY,CAAC,IAAc;IAClC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,OAAO,GAAG;SACP,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,OAAgC,EAAE,aAAqB;IAC3E,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IACpD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,WAAW,EAAE,CAAA;IAE7C,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrB,MAAM,CAAC,GAAG,EAAE,CAAA;IAEZ,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC5C,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAEzC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;IAEpE,IAAI,MAAM,GAAuB,IAAI,CAAA;IAErC,KAAK,UAAU,uBAAuB;QACpC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAC5B,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAA;QACtF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;QAC5E,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAA;QAE9F,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAA;QAEzD,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,GAAG,GAAG;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACvC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAA,CAAC,qCAAqC;QAE9D,MAAM,GAAG,GAAG,YAAY,CACtB;YACE,GAAG;YACH,GAAG;YACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC;SACnB,EACD,UAAU,CACX,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,4CAA4C,cAAc,gBAAgB,EAAE;YACtG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,sBAAsB,EAAE,YAAY;aACrC;SACF,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAExB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QACjE,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;QAElF,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;QAE5C,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO;QACL,OAAO;YACL,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,MAAM,uBAAuB,EAAE,CAAA;gBAC7C,IAAI,KAAK;oBAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;gBACvD,iDAAiD;YACnD,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;YACpC,IAAI,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YAE7C,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/github-reviews.d.ts

@@ -0,0 +1,24 @@
+export interface GitHubUser {
+    login: string;
+    id: number;
+}
+export declare function parsePrUrl(prUrl: string): {
+    owner: string;
+    repo: string;
+    pullNumber: number;
+} | null;
+export declare function githubWhoami(opts: {
+    token: string;
+    fetchImpl?: typeof fetch;
+}): Promise<GitHubUser | null>;
+export declare function approvePullRequest(opts: {
+    token: string;
+    prUrl: string;
+    body?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<{
+    ok: boolean;
+    status: number;
+    message?: string;
+}>;
+//# sourceMappingURL=github-reviews.d.ts.map

package/dist/github-reviews.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-reviews.d.ts","sourceRoot":"","sources":["../src/github-reviews.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;CACX;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMpG;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAahH;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B7D"}

package/dist/github-reviews.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0
+// GitHub PR review operations (approve) using explicit tokens.
+export function parsePrUrl(prUrl) {
+    const match = prUrl.match(/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+    if (!match)
+        return null;
+    const pullNumber = parseInt(match[3], 10);
+    if (!Number.isFinite(pullNumber) || pullNumber <= 0)
+        return null;
+    return { owner: match[1], repo: match[2], pullNumber };
+}
+export async function githubWhoami(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const res = await fetchImpl('https://api.github.com/user', {
+        headers: {
+            Accept: 'application/vnd.github+json',
+            Authorization: `Bearer ${opts.token}`,
+            'X-GitHub-Api-Version': '2022-11-28',
+        },
+    });
+    if (!res.ok)
+        return null;
+    const json = (await res.json());
+    if (!json?.login)
+        return null;
+    return { login: String(json.login), id: Number(json.id) };
+}
+export async function approvePullRequest(opts) {
+    const parsed = parsePrUrl(opts.prUrl);
+    if (!parsed)
+        return { ok: false, status: 400, message: 'Invalid PR URL' };
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const url = `https://api.github.com/repos/${parsed.owner}/${parsed.repo}/pulls/${parsed.pullNumber}/reviews`;
+    const res = await fetchImpl(url, {
+        method: 'POST',
+        headers: {
+            Accept: 'application/vnd.github+json',
+            Authorization: `Bearer ${opts.token}`,
+            'X-GitHub-Api-Version': '2022-11-28',
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ event: 'APPROVE', body: opts.body || '' }),
+    });
+    if (!res.ok) {
+        let detail = '';
+        try {
+            detail = JSON.stringify(await res.json());
+        }
+        catch {
+            detail = await res.text().catch(() => '');
+        }
+        return { ok: false, status: res.status, message: detail || res.statusText };
+    }
+    return { ok: true, status: res.status };
+}
+//# sourceMappingURL=github-reviews.js.map

package/dist/github-reviews.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-reviews.js","sourceRoot":"","sources":["../src/github-reviews.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,+DAA+D;AAO/D,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAA;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAiD;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,6BAA6B,EAAE;QACzD,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,sBAAsB,EAAE,YAAY;SACrC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;IACtC,IAAI,CAAC,IAAI,EAAE,KAAK;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAEzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,GAAG,GAAG,gCAAgC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,UAAU,UAAU,CAAA;IAE5G,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,sBAAsB,EAAE,YAAY;YACpC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;KAClE,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;IAC7E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;AACzC,CAAC"}