@ai-coders/installer 0.3.0

package/dist/products/second-brain/envfile.js

@@ -0,0 +1,136 @@
+/**
+ * Renders and merges the VPS /opt/second-brain/.env file. Merging preserves a
+ * previously initialized database password (rotating it after the postgres
+ * volume exists would break the stack) and the workflow-managed image pins.
+ */
+import { randomBytes } from "node:crypto";
+import { parseEnv } from "node:util";
+/** The placeholder written by deploy/vps-setup.sh before any real install. */
+export const databasePasswordPlaceholder = "replace-with-a-strong-database-password";
+export const vpsEnvPath = "/opt/second-brain/.env";
+/**
+ * Members paste domains in every shape — with https://, trailing slashes,
+ * paths, uppercase. The OAuth server refuses to start unless
+ * SECOND_BRAIN_PUBLIC_URL is a clean HTTPS origin, so normalize here.
+ */
+export function normalizeDomain(value) {
+    let domain = value.trim().toLowerCase();
+    // Strip a leading scheme, tolerating the missing-colon typo (https//x).
+    domain = domain.replace(/^[a-z][a-z0-9+.-]*:?\/\//, "");
+    domain = domain.split("/")[0] ?? "";
+    domain = domain.replace(/\.+$/, "");
+    // Requiring a dot rejects scheme fragments such as "https" that would
+    // otherwise pass as a syntactically valid single-label hostname.
+    if (!domain.includes(".") ||
+        !/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/.test(domain)) {
+        throw new Error("The domain must be a hostname like brain.example.com.");
+    }
+    return domain;
+}
+export function generateDatabasePassword() {
+    return randomBytes(24).toString("base64url");
+}
+export function parseEnvContent(text) {
+    return { ...parseEnv(text) };
+}
+const managedKeys = [
+    "POSTGRES_PASSWORD",
+    "OPENROUTER_API_KEY",
+    "SECOND_BRAIN_PUBLIC_URL",
+    "SECOND_BRAIN_PUBLIC_HOST",
+    "SECOND_BRAIN_HTTP_PORT",
+    "SECOND_BRAIN_OAUTH_PORT",
+    "SECOND_BRAIN_IMAGE",
+    "SECOND_BRAIN_IMAGE_TAG",
+];
+function assertSafeValue(name, value) {
+    if (value.includes("\n") || value.includes("\r") || value.includes("\0")) {
+        throw new Error(`The value for ${name} must not contain line breaks.`);
+    }
+}
+/**
+ * Adds or replaces the static bearer credential lines in the VPS .env. This
+ * runs after owner bootstrap — the principal id does not exist earlier — so
+ * it edits the file in place instead of re-rendering: deploy.sh may have
+ * upserted image pins since write-env, and those must survive.
+ */
+export function withBearerCredentials(content, credentials) {
+    const managed = [
+        ["INVOKTA_HTTP_BEARER_TOKEN", credentials.token],
+        ["INVOKTA_HTTP_PRINCIPAL_ID", credentials.principalId],
+    ];
+    for (const [name, value] of managed)
+        assertSafeValue(name, value);
+    const replaced = new Set();
+    const lines = content
+        .replace(/\n$/, "")
+        .split("\n")
+        .map((line) => {
+        const match = managed.find(([name]) => line.startsWith(`${name}=`));
+        if (match === undefined)
+            return line;
+        replaced.add(match[0]);
+        return `${match[0]}=${match[1]}`;
+    });
+    for (const [name, value] of managed) {
+        if (!replaced.has(name))
+            lines.push(`${name}=${value}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function mergeVpsEnv(input) {
+    const existing = input.existingContent === undefined
+        ? {}
+        : parseEnvContent(input.existingContent);
+    const previousPassword = existing["POSTGRES_PASSWORD"];
+    const keptExistingDatabasePassword = previousPassword !== undefined &&
+        previousPassword !== "" &&
+        previousPassword !== databasePasswordPlaceholder;
+    const databasePassword = keptExistingDatabasePassword
+        ? previousPassword
+        : input.freshDatabasePassword;
+    const domain = normalizeDomain(input.domain);
+    const values = {
+        POSTGRES_PASSWORD: databasePassword,
+        OPENROUTER_API_KEY: input.openRouterApiKey,
+        SECOND_BRAIN_PUBLIC_URL: `https://${domain}`,
+        SECOND_BRAIN_PUBLIC_HOST: domain,
+        SECOND_BRAIN_HTTP_PORT: String(input.hostPorts.httpPort),
+        SECOND_BRAIN_OAUTH_PORT: String(input.hostPorts.oauthPort),
+        SECOND_BRAIN_IMAGE: existing["SECOND_BRAIN_IMAGE"] ?? "second-brain",
+        SECOND_BRAIN_IMAGE_TAG: existing["SECOND_BRAIN_IMAGE_TAG"] ?? "local",
+    };
+    for (const [name, value] of Object.entries(values)) {
+        assertSafeValue(name, value);
+    }
+    const unknownEntries = Object.entries(existing).filter(([key]) => !managedKeys.includes(key));
+    for (const [name, value] of unknownEntries) {
+        assertSafeValue(name, value);
+    }
+    const lines = [
+        "# Required — full variable reference: .env.example in the repo.",
+        `POSTGRES_PASSWORD=${values["POSTGRES_PASSWORD"]}`,
+        `OPENROUTER_API_KEY=${values["OPENROUTER_API_KEY"]}`,
+        `SECOND_BRAIN_PUBLIC_URL=${values["SECOND_BRAIN_PUBLIC_URL"]}`,
+        `SECOND_BRAIN_PUBLIC_HOST=${values["SECOND_BRAIN_PUBLIC_HOST"]}`,
+        "",
+        "# Loopback host ports — provisioned to avoid clashes with other apps:",
+        `SECOND_BRAIN_HTTP_PORT=${values["SECOND_BRAIN_HTTP_PORT"]}`,
+        `SECOND_BRAIN_OAUTH_PORT=${values["SECOND_BRAIN_OAUTH_PORT"]}`,
+        "",
+        "# Managed by deploys — do not edit:",
+        `SECOND_BRAIN_IMAGE=${values["SECOND_BRAIN_IMAGE"]}`,
+        `SECOND_BRAIN_IMAGE_TAG=${values["SECOND_BRAIN_IMAGE_TAG"]}`,
+    ];
+    if (unknownEntries.length > 0) {
+        lines.push("");
+        for (const [name, value] of unknownEntries) {
+            lines.push(`${name}=${value}`);
+        }
+    }
+    return {
+        content: `${lines.join("\n")}\n`,
+        keptExistingDatabasePassword,
+    };
+}
+//# sourceMappingURL=envfile.js.map

package/dist/products/second-brain/envfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envfile.js","sourceRoot":"","sources":["../../../packages/second-brain/src/envfile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GACtC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,wEAAwE;IACxE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,sEAAsE;IACtE,iEAAiE;IACjE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,CAAC,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAA4B,CAAC;AACzD,CAAC;AAeD,MAAM,WAAW,GAAG;IAClB,mBAAmB;IACnB,oBAAoB;IACpB,yBAAyB;IACzB,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,wBAAwB;CACzB,CAAC;AAEF,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,gCAAgC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,WAA8B;IAE9B,MAAM,OAAO,GAA2C;QACtD,CAAC,2BAA2B,EAAE,WAAW,CAAC,KAAK,CAAC;QAChD,CAAC,2BAA2B,EAAE,WAAW,CAAC,WAAW,CAAC;KACvD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;QAAE,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IACL,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,QAAQ,GACZ,KAAK,CAAC,eAAe,KAAK,SAAS;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAE7C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,4BAA4B,GAChC,gBAAgB,KAAK,SAAS;QAC9B,gBAAgB,KAAK,EAAE;QACvB,gBAAgB,KAAK,2BAA2B,CAAC;IACnD,MAAM,gBAAgB,GAAG,4BAA4B;QACnD,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAEhC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAA2B;QACrC,iBAAiB,EAAE,gBAAgB;QACnC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB;QAC1C,uBAAuB,EAAE,WAAW,MAAM,EAAE;QAC5C,wBAAwB,EAAE,MAAM;QAChC,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QACxD,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;QAC1D,kBAAkB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,IAAI,cAAc;QACpE,sBAAsB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,IAAI,OAAO;KACtE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CACtC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;QAC3C,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,iEAAiE;QACjE,qBAAqB,MAAM,CAAC,mBAAmB,CAAC,EAAE;QAClD,sBAAsB,MAAM,CAAC,oBAAoB,CAAC,EAAE;QACpD,2BAA2B,MAAM,CAAC,yBAAyB,CAAC,EAAE;QAC9D,4BAA4B,MAAM,CAAC,0BAA0B,CAAC,EAAE;QAChE,EAAE;QACF,uEAAuE;QACvE,0BAA0B,MAAM,CAAC,wBAAwB,CAAC,EAAE;QAC5D,2BAA2B,MAAM,CAAC,yBAAyB,CAAC,EAAE;QAC9D,EAAE;QACF,qCAAqC;QACrC,sBAAsB,MAAM,CAAC,oBAAoB,CAAC,EAAE;QACpD,0BAA0B,MAAM,CAAC,wBAAwB,CAAC,EAAE;KAC7D,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAChC,4BAA4B;KAC7B,CAAC;AACJ,CAAC"}

package/dist/products/second-brain/github.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Minimal GitHub REST client for the installer. Uses an injected fetch so
+ * tests never touch the network, and never logs the token.
+ */
+export interface RepositoryRef {
+    readonly owner: string;
+    readonly repo: string;
+}
+export declare function parseRepositoryFromRemote(url: string): RepositoryRef | null;
+export interface PermissionCheck {
+    readonly permission: "contents" | "secrets" | "actions";
+    readonly ok: boolean;
+}
+export interface TokenValidation {
+    readonly ok: boolean;
+    readonly unauthorized: boolean;
+    readonly checks: readonly PermissionCheck[];
+    readonly tokenExpiresAt: Date | null;
+}
+export interface WorkflowRun {
+    readonly id: number;
+    readonly headSha: string;
+    readonly displayTitle: string;
+    readonly event: string;
+    readonly status: string;
+    readonly conclusion: string | null;
+    readonly createdAt: Date;
+    readonly htmlUrl: string;
+}
+export interface WorkflowJob {
+    readonly name: string;
+    readonly conclusion: string | null;
+    readonly htmlUrl: string;
+}
+interface GitHubClientOptions {
+    readonly token: string;
+    readonly owner: string;
+    readonly repo: string;
+    readonly fetchLike?: typeof fetch;
+    readonly apiBase?: string;
+    readonly sealSecret?: (publicKey: string, value: string) => Promise<string>;
+}
+export declare class GitHubClient {
+    private readonly token;
+    private readonly owner;
+    private readonly repo;
+    private readonly fetchLike;
+    private readonly apiBase;
+    private readonly sealSecret;
+    private publicKey;
+    constructor(options: GitHubClientOptions);
+    private request;
+    private repoPath;
+    /**
+     * Read-only best-effort probes: real write access is only proven by the
+     * later PUT/POST calls, but a fine-grained token missing a permission
+     * fails these reads with 403/404.
+     */
+    validate(): Promise<TokenValidation>;
+    private getPublicKey;
+    putSecret(name: string, value: string): Promise<void>;
+    dispatchDeploy(imageTag: string | undefined, dispatchedAt: Date): Promise<Date>;
+    /**
+     * Dispatching returns no run id, so correlate: poll for the newest
+     * workflow_dispatch run created at or after dispatch time (minus a minute
+     * of clock skew).
+     */
+    findDispatchedRun(dispatchedAt: Date, options?: {
+        attempts?: number;
+        delayMs?: number;
+        sleep?: (ms: number) => Promise<void>;
+    }): Promise<WorkflowRun>;
+    getRun(id: number): Promise<WorkflowRun>;
+    listRuns(perPage?: number): Promise<WorkflowRun[]>;
+    listJobs(runId: number): Promise<WorkflowJob[]>;
+}
+export {};

package/dist/products/second-brain/github.js

@@ -0,0 +1,195 @@
+/**
+ * Minimal GitHub REST client for the installer. Uses an injected fetch so
+ * tests never touch the network, and never logs the token.
+ */
+export function parseRepositoryFromRemote(url) {
+    const trimmed = url.trim();
+    const patterns = [
+        /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/,
+        /^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/,
+        /^ssh:\/\/git@github\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/,
+    ];
+    for (const pattern of patterns) {
+        const match = trimmed.match(pattern);
+        if (match?.[1] !== undefined && match[2] !== undefined) {
+            return { owner: match[1], repo: match[2] };
+        }
+    }
+    return null;
+}
+const workflowFile = "deploy.yml";
+function toRun(run) {
+    return {
+        id: run.id,
+        headSha: run.head_sha,
+        displayTitle: run.display_title,
+        event: run.event,
+        status: run.status,
+        conclusion: run.conclusion,
+        createdAt: new Date(run.created_at),
+        htmlUrl: run.html_url,
+    };
+}
+export class GitHubClient {
+    token;
+    owner;
+    repo;
+    fetchLike;
+    apiBase;
+    sealSecret;
+    publicKey = null;
+    constructor(options) {
+        this.token = options.token;
+        this.owner = options.owner;
+        this.repo = options.repo;
+        this.fetchLike = options.fetchLike ?? fetch;
+        this.apiBase = options.apiBase ?? "https://api.github.com";
+        this.sealSecret = options.sealSecret;
+    }
+    async request(method, path, body) {
+        const init = {
+            method,
+            headers: {
+                authorization: `Bearer ${this.token}`,
+                accept: "application/vnd.github+json",
+                "x-github-api-version": "2022-11-28",
+                "user-agent": "second-brain-installer",
+                ...(body === undefined ? {} : { "content-type": "application/json" }),
+            },
+        };
+        if (body !== undefined)
+            init.body = JSON.stringify(body);
+        return this.fetchLike(`${this.apiBase}${path}`, init);
+    }
+    repoPath(suffix = "") {
+        return `/repos/${this.owner}/${this.repo}${suffix}`;
+    }
+    /**
+     * Read-only best-effort probes: real write access is only proven by the
+     * later PUT/POST calls, but a fine-grained token missing a permission
+     * fails these reads with 403/404.
+     */
+    async validate() {
+        const probes = [
+            { permission: "contents", path: this.repoPath() },
+            { permission: "secrets", path: this.repoPath("/actions/secrets/public-key") },
+            {
+                permission: "actions",
+                path: this.repoPath(`/actions/workflows/${workflowFile}`),
+            },
+        ];
+        const checks = [];
+        let unauthorized = false;
+        let tokenExpiresAt = null;
+        for (const probe of probes) {
+            const response = await this.request("GET", probe.path);
+            if (response.status === 401)
+                unauthorized = true;
+            const expiration = response.headers.get("github-authentication-token-expiration");
+            if (expiration !== null && tokenExpiresAt === null) {
+                const parsed = new Date(expiration);
+                if (!Number.isNaN(parsed.getTime()))
+                    tokenExpiresAt = parsed;
+            }
+            checks.push({ permission: probe.permission, ok: response.ok });
+        }
+        return {
+            ok: !unauthorized && checks.every((check) => check.ok),
+            unauthorized,
+            checks,
+            tokenExpiresAt,
+        };
+    }
+    async getPublicKey() {
+        if (this.publicKey !== null)
+            return this.publicKey;
+        const response = await this.request("GET", this.repoPath("/actions/secrets/public-key"));
+        if (!response.ok) {
+            throw new Error(`GitHub did not return the secrets public key (HTTP ${response.status}).`);
+        }
+        const data = (await response.json());
+        this.publicKey = { keyId: data.key_id, key: data.key };
+        return this.publicKey;
+    }
+    async putSecret(name, value) {
+        if (this.sealSecret === undefined) {
+            throw new Error("A secret sealer was not configured.");
+        }
+        const publicKey = await this.getPublicKey();
+        const encrypted = await this.sealSecret(publicKey.key, value);
+        const response = await this.request("PUT", this.repoPath(`/actions/secrets/${name}`), { encrypted_value: encrypted, key_id: publicKey.keyId });
+        if (response.status !== 201 && response.status !== 204) {
+            throw new Error(`GitHub rejected the secret ${name} (HTTP ${response.status}).`);
+        }
+    }
+    async dispatchDeploy(imageTag, dispatchedAt) {
+        const response = await this.request("POST", this.repoPath(`/actions/workflows/${workflowFile}/dispatches`), {
+            ref: "main",
+            inputs: imageTag === undefined ? {} : { image_tag: imageTag },
+        });
+        if (response.status !== 204) {
+            throw new Error(`GitHub did not accept the deploy request (HTTP ${response.status}).`);
+        }
+        return dispatchedAt;
+    }
+    /**
+     * Dispatching returns no run id, so correlate: poll for the newest
+     * workflow_dispatch run created at or after dispatch time (minus a minute
+     * of clock skew).
+     */
+    async findDispatchedRun(dispatchedAt, options) {
+        const attempts = options?.attempts ?? 12;
+        const delayMs = options?.delayMs ?? 5000;
+        const sleep = options?.sleep ??
+            ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        const threshold = new Date(dispatchedAt.getTime() - 60_000);
+        const query = new URLSearchParams({
+            event: "workflow_dispatch",
+            created: `>=${threshold.toISOString().slice(0, 16)}`,
+            per_page: "10",
+        });
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            const response = await this.request("GET", this.repoPath(`/actions/workflows/${workflowFile}/runs?${query}`));
+            if (response.ok) {
+                const data = (await response.json());
+                const candidates = data.workflow_runs
+                    .map(toRun)
+                    .filter((run) => run.event === "workflow_dispatch" &&
+                    run.createdAt.getTime() >= threshold.getTime())
+                    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+                const newest = candidates[0];
+                if (newest !== undefined)
+                    return newest;
+            }
+            await sleep(delayMs);
+        }
+        throw new Error("The deploy was requested but its run was not found. Check the repository's Actions tab.");
+    }
+    async getRun(id) {
+        const response = await this.request("GET", this.repoPath(`/actions/runs/${id}`));
+        if (!response.ok) {
+            throw new Error(`GitHub did not return run ${id} (HTTP ${response.status}).`);
+        }
+        return toRun((await response.json()));
+    }
+    async listRuns(perPage = 15) {
+        const response = await this.request("GET", this.repoPath(`/actions/workflows/${workflowFile}/runs?per_page=${perPage}`));
+        if (!response.ok) {
+            throw new Error(`GitHub did not return the run list (HTTP ${response.status}).`);
+        }
+        const data = (await response.json());
+        return data.workflow_runs.map(toRun);
+    }
+    async listJobs(runId) {
+        const response = await this.request("GET", this.repoPath(`/actions/runs/${runId}/jobs`));
+        if (!response.ok)
+            return [];
+        const data = (await response.json());
+        return data.jobs.map((job) => ({
+            name: job.name,
+            conclusion: job.conclusion,
+            htmlUrl: job.html_url,
+        }));
+    }
+}
+//# sourceMappingURL=github.js.map

package/dist/products/second-brain/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../packages/second-brain/src/github.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG;QACf,yDAAyD;QACzD,+CAA+C;QAC/C,wDAAwD;KACzD,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAmDD,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,SAAS,KAAK,CAAC,GAAgB;IAC7B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,QAAQ;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,YAAY;IACN,KAAK,CAAS;IACd,KAAK,CAAS;IACd,IAAI,CAAS;IACb,SAAS,CAAe;IACxB,OAAO,CAAS;IAChB,UAAU,CAEb;IACN,SAAS,GAA0C,IAAI,CAAC;IAEhE,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,IAAI,GAAgB;YACxB,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,MAAM,EAAE,6BAA6B;gBACrC,sBAAsB,EAAE,YAAY;gBACpC,YAAY,EAAE,wBAAwB;gBACtC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aACtE;SACF,CAAC;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IAEO,QAAQ,CAAC,MAAM,GAAG,EAAE;QAC1B,OAAO,UAAU,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAGN;YACJ,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;YACjD,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE;YAC7E;gBACE,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,sBAAsB,YAAY,EAAE,CAAC;aAC1D;SACF,CAAC;QACF,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,cAAc,GAAgB,IAAI,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,YAAY,GAAG,IAAI,CAAC;YACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CACrC,wCAAwC,CACzC,CAAC;YACF,IAAI,UAAU,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAAE,cAAc,GAAG,MAAM,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,YAAY;YACZ,MAAM;YACN,cAAc;SACf,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAC7C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,sDAAsD,QAAQ,CAAC,MAAM,IAAI,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoC,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,KAAa;QACzC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC,EACzC,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CACxD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,UAAU,QAAQ,CAAC,MAAM,IAAI,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAA4B,EAC5B,YAAkB;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,MAAM,EACN,IAAI,CAAC,QAAQ,CAAC,sBAAsB,YAAY,aAAa,CAAC,EAC9D;YACE,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC9D,CACF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,kDAAkD,QAAQ,CAAC,MAAM,IAAI,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,YAAkB,EAClB,OAIC;QAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QACzC,MAAM,KAAK,GACT,OAAO,EAAE,KAAK;YACd,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YAChC,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACpD,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,sBAAsB,YAAY,SAAS,KAAK,EAAE,CAAC,CAClE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;gBACF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa;qBAClC,GAAG,CAAC,KAAK,CAAC;qBACV,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,KAAK,KAAK,mBAAmB;oBACjC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CACjD;qBACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC;YAC1C,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,UAAU,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,sBAAsB,YAAY,kBAAkB,OAAO,EAAE,CAAC,CAC7E,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,4CAA4C,QAAQ,CAAC,MAAM,IAAI,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAC7C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,QAAQ;SACtB,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/products/second-brain/hostinger.d.ts

@@ -0,0 +1,140 @@
+export interface HostingerIpv4Address {
+    readonly id: number;
+    readonly address: string;
+    readonly ptr: string | null;
+}
+export interface HostingerTemplate {
+    readonly id: number;
+    readonly name: string;
+    readonly description: string | null;
+    readonly documentation: string | null;
+}
+export interface HostingerVirtualMachine {
+    readonly id: number;
+    readonly hostname: string;
+    readonly state: string;
+    readonly actionsLock: string;
+    readonly plan: string;
+    readonly template: HostingerTemplate | null;
+    readonly ipv4: readonly HostingerIpv4Address[];
+}
+export type HostingerActionState = "created" | "sent" | "delayed" | "success" | "error";
+export interface HostingerAction {
+    readonly id: number;
+    readonly name: string;
+    readonly state: HostingerActionState;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export type HostingerPasswordIssue = "minimum_length" | "uppercase" | "lowercase" | "number" | "symbol" | "unsupported_character";
+export interface HostingerPasswordValidation {
+    readonly valid: boolean;
+    readonly issues: readonly HostingerPasswordIssue[];
+}
+export interface HostingerPollingOptions {
+    readonly intervalMs?: number;
+    readonly maxIntervalMs?: number;
+    readonly timeoutMs?: number;
+}
+export interface HostingerGetRetryOptions {
+    readonly maxAttempts?: number;
+    readonly baseDelayMs?: number;
+    readonly maxDelayMs?: number;
+}
+export interface HostingerClientOptions {
+    readonly token: string;
+    readonly fetchLike?: typeof fetch;
+    readonly apiBase?: string;
+    readonly sleep?: (ms: number) => Promise<void>;
+    readonly polling?: HostingerPollingOptions;
+    readonly retry?: HostingerGetRetryOptions;
+    readonly random?: () => number;
+    readonly now?: () => number;
+    readonly requestTimeoutMs?: number;
+}
+export type HostingerApiErrorCode = "network_error" | "request_timeout" | "client_closed" | "unauthorized" | "validation_failed" | "rate_limited" | "server_error" | "unexpected_status" | "invalid_response";
+interface HostingerApiErrorOptions {
+    readonly status: number;
+    readonly code: HostingerApiErrorCode;
+    readonly correlationId: string | null;
+    readonly retryable: boolean;
+    readonly retryAfterMs: number | null;
+    readonly validationFields?: readonly string[];
+    readonly message: string;
+    readonly cause?: unknown;
+}
+export declare class HostingerApiError extends Error {
+    name: string;
+    readonly status: number;
+    readonly code: HostingerApiErrorCode;
+    readonly correlationId: string | null;
+    readonly retryable: boolean;
+    readonly retryAfterMs: number | null;
+    readonly validationFields: readonly string[];
+    constructor(options: HostingerApiErrorOptions);
+}
+export declare class HostingerPasswordValidationError extends Error {
+    name: string;
+    readonly issues: readonly HostingerPasswordIssue[];
+    constructor(issues: readonly HostingerPasswordIssue[]);
+}
+export declare class HostingerActionFailedError extends Error {
+    name: string;
+    readonly virtualMachineId: number;
+    readonly actionId: number;
+    readonly correlationId: string | null;
+    constructor(options: {
+        virtualMachineId: number;
+        actionId: number;
+        correlationId: string | null;
+    });
+}
+export declare class HostingerActionTimeoutError extends Error {
+    name: string;
+    readonly virtualMachineId: number;
+    readonly actionId: number;
+    readonly timeoutMs: number;
+    readonly correlationId: string | null;
+    constructor(options: {
+        virtualMachineId: number;
+        actionId: number;
+        timeoutMs: number;
+        correlationId: string | null;
+    });
+}
+export declare class HostingerActionOutcomeUnknownError extends Error {
+    name: string;
+    readonly virtualMachineId: number;
+    readonly actionId: number;
+    readonly correlationId: string | null;
+    readonly reason: "poll_failed" | "poll_timeout";
+    constructor(options: {
+        virtualMachineId: number;
+        actionId: number;
+        correlationId: string | null;
+        reason: "poll_failed" | "poll_timeout";
+    });
+}
+export declare const hostingerRootPasswordSymbols = "-().&@?'#,/;+";
+export declare function validateHostingerRootPassword(password: string): HostingerPasswordValidation;
+export declare class HostingerClient {
+    private token;
+    private readonly fetchLike;
+    private readonly apiBase;
+    private readonly sleep;
+    private readonly polling;
+    private readonly retry;
+    private readonly random;
+    private readonly now;
+    private readonly requestTimeoutMs;
+    private readonly activeRequests;
+    constructor(options: HostingerClientOptions);
+    private request;
+    private getRetryDelayMs;
+    private getJitteredDelayMs;
+    private requestActionWithRetries;
+    listVirtualMachines(): Promise<readonly HostingerVirtualMachine[]>;
+    close(): void;
+    setRootPassword(virtualMachineId: number, password: string, polling?: HostingerPollingOptions): Promise<HostingerAction>;
+}
+export {};