repo-sdk 0.3.2 → 0.3.4

package/dist/github.d.ts

@@ -21,6 +21,12 @@ interface GitHubAppAuth {
    * installation's account. Omitted: every repository the installation can access.
    */
   repositories?: string[];
+  /**
+   * Restrict the minted installation token to these repository ids. Ids survive a
+   * repository rename, so prefer them over `repositories` when the repository is
+   * stored long-term. Mutually exclusive with `repositories`.
+   */
+  repositoryIds?: Array<string | number>;
 }
 interface GitHubTokenProviderAuth {
   /** Mints a bearer token per request; re-invoked with `forceRefresh` after a 401, then retried once. */

package/dist/github.js

@@ -3,6 +3,15 @@ import { a as isRecord, c as assertSameOriginUrl, d as bytesToBase64Url, i as fi
 import { t as HttpClient } from "./http-DOXOhL_I.js";
 import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/github/app-auth.ts
+/** GitHub repository ids are positive integers; anything else would only surface as an opaque 422. */
+function toRepositoryId(value) {
+	const id = typeof value === "string" && /^\d+$/.test(value) ? Number(value) : value;
+	if (typeof id !== "number" || !Number.isSafeInteger(id) || id <= 0) throw new RepoError(`Invalid GitHub repository id: ${String(value)}`, {
+		code: "validation",
+		provider: "github"
+	});
+	return id;
+}
 const RSA_ALGORITHM_IDENTIFIER = [
 	48,
 	13,
@@ -125,6 +134,7 @@ var AppTokenSource = class {
 	installationId;
 	owner;
 	repositories;
+	repositoryIds;
 	cached;
 	refresh;
 	constructor(options) {
@@ -132,6 +142,10 @@ var AppTokenSource = class {
 			code: "validation",
 			provider: "github"
 		});
+		if (options.repositories !== void 0 && options.repositoryIds !== void 0) throw new RepoError("GitHub App auth accepts either repositories or repositoryIds, not both", {
+			code: "validation",
+			provider: "github"
+		});
 		this.appId = String(options.appId);
 		this.privateKey = options.privateKey;
 		this.baseUrl = options.baseUrl;
@@ -141,6 +155,7 @@ var AppTokenSource = class {
 		this.installationId = options.installationId === void 0 ? void 0 : String(options.installationId);
 		this.owner = options.owner;
 		this.repositories = options.repositories;
+		this.repositoryIds = options.repositoryIds?.map(toRepositoryId);
 	}
 	async getToken() {
 		return (await this.resolveToken()).token;
@@ -176,7 +191,7 @@ var AppTokenSource = class {
 			privateKey: this.privateKey
 		});
 		const installationId = await this.resolveInstallationId(jwt);
-		const data = await this.appRequest(`/app/installations/${installationId}/access_tokens`, "POST", jwt, this.repositories === void 0 ? void 0 : { repositories: this.repositories });
+		const data = await this.appRequest(`/app/installations/${installationId}/access_tokens`, "POST", jwt, this.tokenScope());
 		const token = {
 			token: data.token,
 			expiresAt: new Date(data.expires_at)
@@ -184,6 +199,11 @@ var AppTokenSource = class {
 		this.cached = token;
 		return token;
 	}
+	/** Body of the access-token request; `undefined` mints an unrestricted token. */
+	tokenScope() {
+		if (this.repositoryIds !== void 0) return { repository_ids: this.repositoryIds };
+		if (this.repositories !== void 0) return { repositories: this.repositories };
+	}
 	async resolveInstallationId(jwt) {
 		if (this.installationId !== void 0) return this.installationId;
 		this.installationId = this.owner === void 0 ? await this.lookupSingleInstallation(jwt) : await this.lookupOwnerInstallation(jwt, this.owner);
@@ -325,6 +345,7 @@ function createTokenSource(auth, baseUrl, fetchImpl) {
 		installationId: auth.installationId,
 		owner: auth.owner,
 		repositories: auth.repositories,
+		repositoryIds: auth.repositoryIds,
 		baseUrl,
 		fetchImpl,
 		apiVersion: API_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-sdk",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Unified TypeScript SDK for git providers — GitHub, GitLab, Bitbucket, Azure DevOps, Gitea",
   "license": "MIT",
   "author": "Robin Genz <mail@robingenz.dev>",