@alchemy.run/pkg 0.0.0-placeholder → 2.0.0-beta.78

package/dist/Protocol.d.ts

@@ -0,0 +1,186 @@
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+/**
+ * The HTTP contract between the `pkg` CLI and the registry Worker, as an
+ * `HttpApi`. The Worker implements it with `HttpApiBuilder`; the CLI calls
+ * it through `HttpApiClient`. Importing this file pulls in no runtime code.
+ */
+/**
+ * The GitHub Actions run a request comes from. It is a lookup hint, not a
+ * credential: the registry resolves the run through the GitHub API and
+ * trusts only what GitHub says about it.
+ */
+export declare const RunRef: Schema.Struct<{
+    readonly repo: Schema.String;
+    readonly runId: Schema.Number;
+    readonly attempt: Schema.Number;
+}>;
+export type RunRef = typeof RunRef.Type;
+/**
+ * Name of the artifact a job uploads to its own run to vouch for a manifest.
+ * Only the job holds the runtime token that can add artifacts to the run, so
+ * an artifact carrying the manifest's hash is GitHub's record that this run
+ * approved exactly these package hashes.
+ */
+export declare const manifestArtifactName: (sha256: string) => string;
+/** Lowercase hex SHA-256. */
+export declare const Sha256: Schema.String;
+export declare const TarballRef: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly sha256: Schema.String;
+}>;
+export type TarballRef = typeof TarballRef.Type;
+declare const BadRequest_base: Schema.Class<BadRequest, Schema.TaggedStruct<"BadRequest", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The request names no usable run, or carries an invalid body. */
+export declare class BadRequest extends BadRequest_base {
+}
+declare const Forbidden_base: Schema.Class<Forbidden, Schema.TaggedStruct<"Forbidden", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The repository may not publish, or the run has not vouched for the manifest. */
+export declare class Forbidden extends Forbidden_base {
+}
+declare const RunNotInProgress_base: Schema.Class<RunNotInProgress, Schema.TaggedStruct<"RunNotInProgress", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Requests come from inside a run, so a finished run cannot publish. */
+export declare class RunNotInProgress extends RunNotInProgress_base {
+}
+declare const MissingTarballs_base: Schema.Class<MissingTarballs, Schema.TaggedStruct<"MissingTarballs", {
+    readonly missing: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly sha256: Schema.String;
+    }>>;
+}>, import("effect/Cause").YieldableError>;
+/** Upload these, then publish again. */
+export declare class MissingTarballs extends MissingTarballs_base {
+}
+declare const PackageTooLarge_base: Schema.Class<PackageTooLarge, Schema.TaggedStruct<"PackageTooLarge", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class PackageTooLarge extends PackageTooLarge_base {
+}
+declare const Upstream_base: Schema.Class<Upstream, Schema.TaggedStruct<"Upstream", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** GitHub could not be reached or answered with an error. */
+export declare class Upstream extends Upstream_base {
+}
+export declare const PublishedPackage: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly group: Schema.String;
+    /** Install URL pinned to the commit. */
+    readonly url: Schema.String;
+    readonly tags: Schema.$Array<Schema.String>;
+}>;
+export type PublishedPackage = typeof PublishedPackage.Type;
+export declare const PublishResponse: Schema.Struct<{
+    readonly packages: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly group: Schema.String;
+        /** Install URL pinned to the commit. */
+        readonly url: Schema.String;
+        readonly tags: Schema.$Array<Schema.String>;
+    }>>;
+}>;
+export type PublishResponse = typeof PublishResponse.Type;
+/**
+ * `manifest` is the exact `pkg-manifest.json` text the job vouched for; its
+ * SHA-256 must match an artifact on the run. Idempotent: the registry
+ * either fails with {@link MissingTarballs} or writes the tags.
+ */
+export declare const publish: HttpApiEndpoint.HttpApiEndpoint<"publish", "POST", "/api/publish", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly run: Schema.Struct<{
+        readonly repo: Schema.String;
+        readonly runId: Schema.Number;
+        readonly attempt: Schema.Number;
+    }>;
+    readonly manifest: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly packages: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly group: Schema.String;
+        /** Install URL pinned to the commit. */
+        readonly url: Schema.String;
+        readonly tags: Schema.$Array<Schema.String>;
+    }>>;
+}>>, Schema.toCodecJson<typeof BadRequest | typeof Forbidden | typeof RunNotInProgress | typeof MissingTarballs | typeof PackageTooLarge | typeof Upstream>, never, never>;
+export declare const TarballResponse: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly sha256: Schema.String;
+    readonly size: Schema.Number;
+    readonly uploaded: Schema.Boolean;
+}>;
+export type TarballResponse = typeof TarballResponse.Type;
+/**
+ * Content-addressed upload. Any in-progress run of an allowed repository
+ * may upload; bytes only become reachable once a vouched manifest tags
+ * them. The run travels in the query because the body is the tarball.
+ */
+export declare const uploadTarball: HttpApiEndpoint.HttpApiEndpoint<"uploadTarball", "PUT", "/api/tarballs/:name/:sha256", Schema.toCodecStringTree<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly sha256: Schema.String;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+    readonly repo: Schema.String;
+    readonly runId: Schema.Number;
+    readonly attempt: Schema.Number;
+}>>, Schema.toCodecJson<Schema.Uint8Array>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly sha256: Schema.String;
+    readonly size: Schema.Number;
+    readonly uploaded: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof BadRequest | typeof Forbidden | typeof RunNotInProgress | typeof PackageTooLarge | typeof Upstream>, never, never>;
+export declare const health: HttpApiEndpoint.HttpApiEndpoint<"health", "GET", "/api/health", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly ok: Schema.Boolean;
+}>>, never, never, never>;
+declare const Registry_base: HttpApiGroup.HttpApiGroup<"Registry", HttpApiEndpoint.HttpApiEndpoint<"publish", "POST", "/api/publish", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly run: Schema.Struct<{
+        readonly repo: Schema.String;
+        readonly runId: Schema.Number;
+        readonly attempt: Schema.Number;
+    }>;
+    readonly manifest: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly packages: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly group: Schema.String;
+        /** Install URL pinned to the commit. */
+        readonly url: Schema.String;
+        readonly tags: Schema.$Array<Schema.String>;
+    }>>;
+}>>, Schema.toCodecJson<typeof BadRequest | typeof Forbidden | typeof RunNotInProgress | typeof MissingTarballs | typeof PackageTooLarge | typeof Upstream>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"uploadTarball", "PUT", "/api/tarballs/:name/:sha256", Schema.toCodecStringTree<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly sha256: Schema.String;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+    readonly repo: Schema.String;
+    readonly runId: Schema.Number;
+    readonly attempt: Schema.Number;
+}>>, Schema.toCodecJson<Schema.Uint8Array>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly sha256: Schema.String;
+    readonly size: Schema.Number;
+    readonly uploaded: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof BadRequest | typeof Forbidden | typeof RunNotInProgress | typeof PackageTooLarge | typeof Upstream>, never, never>, false>;
+export declare class Registry extends Registry_base {
+}
+declare const Health_base: HttpApiGroup.HttpApiGroup<"Health", HttpApiEndpoint.HttpApiEndpoint<"health", "GET", "/api/health", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly ok: Schema.Boolean;
+}>>, never, never, never>, false>;
+export declare class Health extends Health_base {
+}
+declare const PkgApi_base: HttpApi.HttpApi<"Pkg", typeof Registry | typeof Health>;
+export declare class PkgApi extends PkgApi_base {
+}
+/**
+ * Immutable tarball URL on the registry. Dependencies between packed
+ * packages link to these, so a tarball's bytes depend only on its own
+ * source and its dependencies' bytes, never on a commit, and identical
+ * builds deduplicate across commits, pull requests, and repositories.
+ */
+export declare const tarballUrl: (registry: string, name: string, sha256: string) => string;
+export {};
+//# sourceMappingURL=Protocol.d.ts.map

package/dist/Protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Protocol.d.ts","sourceRoot":"","sources":["../src/Protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,KAAK,eAAe,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAC;AAIrE;;;;GAIG;AAEH;;;;GAIG;AACH,eAAO,MAAM,MAAM;;;;EAIjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,WAAY,MAAM,WACzB,CAAC;AAE3B,6BAA6B;AAC7B,eAAO,MAAM,MAAM,eAElB,CAAC;AAEF,eAAO,MAAM,UAAU;;;EAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;;;AAEhD,mEAAmE;AACnE,qBAAa,UAAW,SAAQ,eAI/B;CAAG;;;;AAEJ,mFAAmF;AACnF,qBAAa,SAAU,SAAQ,cAI9B;CAAG;;;;AAEJ,yEAAyE;AACzE,qBAAa,gBAAiB,SAAQ,qBAIrC;CAAG;;;;;;;AAEJ,wCAAwC;AACxC,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;;;;AAEJ,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;;;;AAEJ,6DAA6D;AAC7D,qBAAa,QAAS,SAAQ,aAI7B;CAAG;AAEJ,eAAO,MAAM,gBAAgB;;;IAG3B,wCAAwC;;;EAGxC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;QAN1B,wCAAwC;;;;EAQxC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;QAhBlB,wCAAwC;;;;0KA2BxC,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;EAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;iJAUzB,CAAC;AAEF,eAAO,MAAM,MAAM;;yBAEjB,CAAC;;;;;;;;;;;;QAxDD,wCAAwC;;;;;;;;;;;;;;;;;AA0D1C,qBAAa,QAAS,SAAQ,aAET;CAAG;;;;AAExB,qBAAa,MAAO,SAAQ,WAAuC;CAAG;;AAEtE,qBAAa,MAAO,SAAQ,WAA6C;CAAG;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,UAAU,aAAc,MAAM,QAAQ,MAAM,UAAU,MAAM,WACd,CAAC"}

package/dist/Protocol.js

@@ -0,0 +1,115 @@
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import * as HttpApiSchema from "effect/unstable/httpapi/HttpApiSchema";
+import { PackageName } from "./Manifest.js";
+/**
+ * The HTTP contract between the `pkg` CLI and the registry Worker, as an
+ * `HttpApi`. The Worker implements it with `HttpApiBuilder`; the CLI calls
+ * it through `HttpApiClient`. Importing this file pulls in no runtime code.
+ */
+/**
+ * The GitHub Actions run a request comes from. It is a lookup hint, not a
+ * credential: the registry resolves the run through the GitHub API and
+ * trusts only what GitHub says about it.
+ */
+export const RunRef = Schema.Struct({
+    repo: Schema.String,
+    runId: Schema.Number,
+    attempt: Schema.Number,
+});
+/**
+ * Name of the artifact a job uploads to its own run to vouch for a manifest.
+ * Only the job holds the runtime token that can add artifacts to the run, so
+ * an artifact carrying the manifest's hash is GitHub's record that this run
+ * approved exactly these package hashes.
+ */
+export const manifestArtifactName = (sha256) => `pkg-manifest-${sha256}`;
+/** Lowercase hex SHA-256. */
+export const Sha256 = Schema.String.pipe(Schema.check(Schema.isPattern(/^[a-f0-9]{64}$/)));
+export const TarballRef = Schema.Struct({
+    name: PackageName,
+    sha256: Sha256,
+});
+/** The request names no usable run, or carries an invalid body. */
+export class BadRequest extends Schema.TaggedError()("BadRequest", { message: Schema.String }, { httpApiStatus: 400 }) {
+}
+/** The repository may not publish, or the run has not vouched for the manifest. */
+export class Forbidden extends Schema.TaggedError()("Forbidden", { message: Schema.String }, { httpApiStatus: 403 }) {
+}
+/** Requests come from inside a run, so a finished run cannot publish. */
+export class RunNotInProgress extends Schema.TaggedError()("RunNotInProgress", { message: Schema.String }, { httpApiStatus: 409 }) {
+}
+/** Upload these, then publish again. */
+export class MissingTarballs extends Schema.TaggedError()("MissingTarballs", { missing: Schema.Array(TarballRef) }, { httpApiStatus: 409 }) {
+}
+export class PackageTooLarge extends Schema.TaggedError()("PackageTooLarge", { message: Schema.String }, { httpApiStatus: 413 }) {
+}
+/** GitHub could not be reached or answered with an error. */
+export class Upstream extends Schema.TaggedError()("Upstream", { message: Schema.String }, { httpApiStatus: 502 }) {
+}
+export const PublishedPackage = Schema.Struct({
+    name: Schema.String,
+    group: Schema.String,
+    /** Install URL pinned to the commit. */
+    url: Schema.String,
+    tags: Schema.Array(Schema.String),
+});
+export const PublishResponse = Schema.Struct({
+    packages: Schema.Array(PublishedPackage),
+});
+/**
+ * `manifest` is the exact `pkg-manifest.json` text the job vouched for; its
+ * SHA-256 must match an artifact on the run. Idempotent: the registry
+ * either fails with {@link MissingTarballs} or writes the tags.
+ */
+export const publish = HttpApiEndpoint.post("publish", "/api/publish", {
+    payload: Schema.Struct({ run: RunRef, manifest: Schema.String }),
+    success: PublishResponse,
+    error: [
+        BadRequest,
+        Forbidden,
+        RunNotInProgress,
+        MissingTarballs,
+        PackageTooLarge,
+        Upstream,
+    ],
+});
+export const TarballResponse = Schema.Struct({
+    name: Schema.String,
+    sha256: Sha256,
+    size: Schema.Number,
+    uploaded: Schema.Boolean,
+});
+/**
+ * Content-addressed upload. Any in-progress run of an allowed repository
+ * may upload; bytes only become reachable once a vouched manifest tags
+ * them. The run travels in the query because the body is the tarball.
+ */
+export const uploadTarball = HttpApiEndpoint.put("uploadTarball", "/api/tarballs/:name/:sha256", {
+    params: TarballRef,
+    query: RunRef,
+    payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
+    success: TarballResponse,
+    error: [BadRequest, Forbidden, RunNotInProgress, PackageTooLarge, Upstream],
+});
+export const health = HttpApiEndpoint.get("health", "/api/health", {
+    success: Schema.Struct({ ok: Schema.Boolean }),
+});
+export class Registry extends HttpApiGroup.make("Registry")
+    .add(publish)
+    .add(uploadTarball) {
+}
+export class Health extends HttpApiGroup.make("Health").add(health) {
+}
+export class PkgApi extends HttpApi.make("Pkg").add(Registry).add(Health) {
+}
+/**
+ * Immutable tarball URL on the registry. Dependencies between packed
+ * packages link to these, so a tarball's bytes depend only on its own
+ * source and its dependencies' bytes, never on a commit, and identical
+ * builds deduplicate across commits, pull requests, and repositories.
+ */
+export const tarballUrl = (registry, name, sha256) => `${registry.replace(/\/+$/, "")}/${name}/-/${sha256}.tgz`;
+//# sourceMappingURL=Protocol.js.map

package/dist/Protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Protocol.js","sourceRoot":"","sources":["../src/Protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,iCAAiC,CAAC;AAC3D,OAAO,KAAK,eAAe,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAC;AACrE,OAAO,KAAK,aAAa,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,EAAE,CACrD,gBAAgB,MAAM,EAAE,CAAC;AAE3B,6BAA6B;AAC7B,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,MAAM;CACf,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,WAAW,EAAc,CAC9D,YAAY,EACZ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAC1B,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB;CAAG;AAEJ,mFAAmF;AACnF,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAC5D,WAAW,EACX,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAC1B,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB;CAAG;AAEJ,yEAAyE;AACzE,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAC1E,kBAAkB,EAClB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAC1B,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB;CAAG;AAEJ,wCAAwC;AACxC,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CACxE,iBAAiB,EACjB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EACrC,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB;CAAG;AAEJ,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CACxE,iBAAiB,EACjB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAC1B,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB;CAAG;AAEJ,6DAA6D;AAC7D,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,WAAW,EAAY,CAC1D,UAAU,EACV,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAC1B,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB;CAAG;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC,MAAM;IAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACzC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE;IACrE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAChE,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE;QACL,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,eAAe;QACf,eAAe;QACf,QAAQ;KACT;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,QAAQ,EAAE,MAAM,CAAC,OAAO;CACzB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAC9C,eAAe,EACf,6BAA6B,EAC7B;IACE,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;IAC7D,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,QAAQ,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE;IACjE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,OAAO,QAAS,SAAQ,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;KACxD,GAAG,CAAC,OAAO,CAAC;KACZ,GAAG,CAAC,aAAa,CAAC;CAAG;AAExB,MAAM,OAAO,MAAO,SAAQ,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;CAAG;AAEtE,MAAM,OAAO,MAAO,SAAQ,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;CAAG;AAE5E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE,CAC3E,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,MAAM,MAAM,MAAM,CAAC"}

package/dist/Registry/Bindings.d.ts

@@ -0,0 +1,134 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import type * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
+import type * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+/**
+ * What the registry Worker binds: its three resources, the settings binding
+ * that carries the policy into the isolate, and the credential bindings.
+ * Shared by `Registry.ts` (which declares the Worker) and the runtime
+ * modules in this folder.
+ */
+/**
+ * Registry policy. The `Type` side is what the Worker runs against
+ * (`Duration`, `ByteSize`); the `Encoded` side is plain JSON, which is how
+ * the policy crosses into the isolate as a Worker binding.
+ */
+export declare const Policy: Schema.Struct<{
+    /**
+     * Repositories allowed to publish, as `owner/name`. A publication may
+     * contain any package; every package gets the commit, short commit,
+     * `branch:` and `pr:` tags of the run that produced it.
+     */
+    readonly repos: Schema.$Array<Schema.String>;
+    /**
+     * How long a publication lives: from the push for branch publications,
+     * from close or merge for pull request publications. Publishing the same
+     * content again refreshes the clock.
+     */
+    readonly ttl: Schema.DurationFromMillis;
+    /** Upper bound on a single tarball. Absent means unlimited. */
+    readonly maxPackageSize: Schema.optionalKey<Schema.ByteSizeFromNumber>;
+}>;
+export type Policy = typeof Policy.Type;
+/**
+ * Everything the Worker needs that is plain data. Encoded into the
+ * {@link SETTINGS_ENV} binding at deploy time and decoded back inside the
+ * isolate, so the deploy-time and runtime views of the registry are the
+ * same value by construction.
+ */
+export declare const Settings: Schema.Struct<{
+    readonly policy: Schema.Struct<{
+        /**
+         * Repositories allowed to publish, as `owner/name`. A publication may
+         * contain any package; every package gets the commit, short commit,
+         * `branch:` and `pr:` tags of the run that produced it.
+         */
+        readonly repos: Schema.$Array<Schema.String>;
+        /**
+         * How long a publication lives: from the push for branch publications,
+         * from close or merge for pull request publications. Publishing the same
+         * content again refreshes the clock.
+         */
+        readonly ttl: Schema.DurationFromMillis;
+        /** Upper bound on a single tarball. Absent means unlimited. */
+        readonly maxPackageSize: Schema.optionalKey<Schema.ByteSizeFromNumber>;
+    }>;
+    /**
+     * Hostname to package scope. Requests on an aliased host resolve an
+     * unscoped name under that scope, so `pkg.distilled.cloud/core/<sha>`
+     * serves `@distilled.cloud/core`.
+     */
+    readonly aliases: Schema.$Record<Schema.String, Schema.String>;
+    /** Cron expression for the expiry sweep. */
+    readonly cron: Schema.String;
+    readonly github: Schema.Struct<{
+        readonly apiUrl: Schema.String;
+    }>;
+}>;
+export type Settings = typeof Settings.Type;
+/**
+ * Worker props the registry forwards verbatim. `main`, `env`, and `crons`
+ * are owned by the registry itself.
+ */
+export type WorkerOverrides = Omit<Cloudflare.WorkerProps, "main" | "env" | "crons">;
+export interface GitHubCredentials {
+    /** The App id. Read from the deploy environment, bound to the Worker. */
+    readonly appId: Config.Config<string>;
+    /** The App's private key PEM. Bound to the Worker as a secret. */
+    readonly privateKey: Config.Config<Redacted.Redacted<string>>;
+}
+declare const RegistryConfig_base: Context.ServiceClass<RegistryConfig, "@alchemy.run/pkg/RegistryConfig", {
+    readonly policy: {
+        readonly repos: readonly string[];
+        readonly ttl: Duration.Duration;
+        readonly maxPackageSize?: import("effect/ByteSize").ByteSize | undefined;
+    };
+    readonly aliases: {
+        readonly [x: string]: string;
+    };
+    readonly cron: string;
+    readonly github: {
+        readonly apiUrl: string;
+    };
+} & {
+    readonly worker: WorkerOverrides;
+    readonly github: Settings["github"] & GitHubCredentials;
+}>;
+/**
+ * The resolved registry configuration, provided to the Worker's Init phase.
+ * At plan time it is the value `PkgRegistry(id, options)` built from the
+ * caller's options; inside the isolate it is rebuilt from the Worker's
+ * bindings (see `RegistryConfigFromEnv` in `Registry.ts`). Either way the
+ * handler code sees one shape.
+ */
+export declare class RegistryConfig extends RegistryConfig_base {
+}
+/** Worker `json` binding carrying the encoded {@link Settings}. */
+export declare const SETTINGS_ENV = "PKG_SETTINGS";
+/** Worker env var the GitHub App id is bound under. */
+export declare const APP_ID_ENV = "PKG_GITHUB_APP_ID";
+/** Worker secret the GitHub App private key PEM is bound under. */
+export declare const PRIVATE_KEY_ENV = "PKG_GITHUB_APP_PRIVATE_KEY";
+export declare const DEFAULT_TTL: Duration.Duration;
+export declare const DEFAULT_CRON = "0 * * * *";
+export declare const DEFAULT_API_URL = "https://api.github.com";
+/** Marker that identifies the sticky install comment. */
+export declare const COMMENT_MARKER = "<!-- pkg-preview-comment -->";
+/** Uploaded tarballs no tag points at are deleted once older than this. */
+export declare const ORPHAN_GRACE: Duration.Duration;
+/** Tags tied to pull requests are re-checked when due within this window. */
+export declare const SWEEP_LOOKAHEAD: Duration.Duration;
+/** Content-addressed tarballs, keyed `<encoded name>/<sha256>.tgz`. */
+export declare const Bucket: import("effect/Effect").Effect<Cloudflare.R2.Bucket, never, Cloudflare.Providers>;
+export declare const tarballKey: (name: string, sha256: string) => string;
+/** Publications, tags, and tarball bookkeeping. */
+export declare const Database: import("effect/Effect").Effect<Cloudflare.D1.Database, never, Cloudflare.Providers>;
+/**
+ * Resolved runs and installation tokens, shared by every isolate of the
+ * Worker. Everything in it is re-derivable from GitHub; see `KVCache.ts`.
+ */
+export declare const Cache: import("effect/Effect").Effect<Cloudflare.KV.Namespace, never, Cloudflare.Providers>;
+export {};
+//# sourceMappingURL=Bindings.d.ts.map

package/dist/Registry/Bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bindings.d.ts","sourceRoot":"","sources":["../../src/Registry/Bindings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,MAAM;IACjB;;;;OAIG;;IAEH;;;;OAIG;;IAEH,+DAA+D;;EAE/D,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;QAvBnB;;;;WAIG;;QAEH;;;;WAIG;;QAEH,+DAA+D;;;IAa/D;;;;OAIG;;IAEH,4CAA4C;;;;;EAK5C,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,UAAU,CAAC,WAAW,EACtB,MAAM,GAAG,KAAK,GAAG,OAAO,CACzB,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;CAC/D;;;;;;;;;;;;;;;qBAYoB,eAAe;qBACf,QAAQ,CAAC,QAAQ,CAAC,GAAG,iBAAiB;;AAX3D;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,mBAME;CAAG;AAEzC,mEAAmE;AACnE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,uDAAuD;AACvD,eAAO,MAAM,UAAU,sBAAsB,CAAC;AAE9C,mEAAmE;AACnE,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAE5D,eAAO,MAAM,WAAW,mBAAoB,CAAC;AAC7C,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,cAAc,iCAAiC,CAAC;AAE7D,2EAA2E;AAC3E,eAAO,MAAM,YAAY,mBAAqB,CAAC;AAE/C,6EAA6E;AAC7E,eAAO,MAAM,eAAe,mBAAoB,CAAC;AAEjD,uEAAuE;AACvE,eAAO,MAAM,MAAM,mFAAyD,CAAC;AAE7E,eAAO,MAAM,UAAU,SAAU,MAAM,UAAU,MAAM,WACV,CAAC;AAU9C,mDAAmD;AACnD,eAAO,MAAM,QAAQ,qFAAqD,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,KAAK,sFAAmC,CAAC"}

package/dist/Registry/Bindings.js

@@ -0,0 +1,92 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
+import * as Schema from "effect/Schema";
+/**
+ * What the registry Worker binds: its three resources, the settings binding
+ * that carries the policy into the isolate, and the credential bindings.
+ * Shared by `Registry.ts` (which declares the Worker) and the runtime
+ * modules in this folder.
+ */
+/**
+ * Registry policy. The `Type` side is what the Worker runs against
+ * (`Duration`, `ByteSize`); the `Encoded` side is plain JSON, which is how
+ * the policy crosses into the isolate as a Worker binding.
+ */
+export const Policy = Schema.Struct({
+    /**
+     * Repositories allowed to publish, as `owner/name`. A publication may
+     * contain any package; every package gets the commit, short commit,
+     * `branch:` and `pr:` tags of the run that produced it.
+     */
+    repos: Schema.Array(Schema.String),
+    /**
+     * How long a publication lives: from the push for branch publications,
+     * from close or merge for pull request publications. Publishing the same
+     * content again refreshes the clock.
+     */
+    ttl: Schema.DurationFromMillis,
+    /** Upper bound on a single tarball. Absent means unlimited. */
+    maxPackageSize: Schema.optionalKey(Schema.ByteSizeFromNumber),
+});
+/**
+ * Everything the Worker needs that is plain data. Encoded into the
+ * {@link SETTINGS_ENV} binding at deploy time and decoded back inside the
+ * isolate, so the deploy-time and runtime views of the registry are the
+ * same value by construction.
+ */
+export const Settings = Schema.Struct({
+    policy: Policy,
+    /**
+     * Hostname to package scope. Requests on an aliased host resolve an
+     * unscoped name under that scope, so `pkg.distilled.cloud/core/<sha>`
+     * serves `@distilled.cloud/core`.
+     */
+    aliases: Schema.Record(Schema.String, Schema.String),
+    /** Cron expression for the expiry sweep. */
+    cron: Schema.String,
+    github: Schema.Struct({
+        apiUrl: Schema.String,
+    }),
+});
+/**
+ * The resolved registry configuration, provided to the Worker's Init phase.
+ * At plan time it is the value `PkgRegistry(id, options)` built from the
+ * caller's options; inside the isolate it is rebuilt from the Worker's
+ * bindings (see `RegistryConfigFromEnv` in `Registry.ts`). Either way the
+ * handler code sees one shape.
+ */
+export class RegistryConfig extends Context.Service()("@alchemy.run/pkg/RegistryConfig") {
+}
+/** Worker `json` binding carrying the encoded {@link Settings}. */
+export const SETTINGS_ENV = "PKG_SETTINGS";
+/** Worker env var the GitHub App id is bound under. */
+export const APP_ID_ENV = "PKG_GITHUB_APP_ID";
+/** Worker secret the GitHub App private key PEM is bound under. */
+export const PRIVATE_KEY_ENV = "PKG_GITHUB_APP_PRIVATE_KEY";
+export const DEFAULT_TTL = Duration.weeks(1);
+export const DEFAULT_CRON = "0 * * * *";
+export const DEFAULT_API_URL = "https://api.github.com";
+/** Marker that identifies the sticky install comment. */
+export const COMMENT_MARKER = "<!-- pkg-preview-comment -->";
+/** Uploaded tarballs no tag points at are deleted once older than this. */
+export const ORPHAN_GRACE = Duration.hours(24);
+/** Tags tied to pull requests are re-checked when due within this window. */
+export const SWEEP_LOOKAHEAD = Duration.hours(2);
+/** Content-addressed tarballs, keyed `<encoded name>/<sha256>.tgz`. */
+export const Bucket = Cloudflare.R2.Bucket("Bucket", { forceDestroy: true });
+export const tarballKey = (name, sha256) => `${encodeURIComponent(name)}/${sha256}.tgz`;
+// The migrations ship inside this package. `import.meta.url` is a file URL
+// during plan/deploy and absent or opaque inside the isolate, where the
+// resource declaration is only evaluated for its binding.
+const migrations = typeof import.meta.url === "string" && import.meta.url.startsWith("file:")
+    ? decodeURIComponent(new URL("../../migrations", import.meta.url).pathname)
+    : undefined;
+/** Publications, tags, and tarball bookkeeping. */
+export const Database = Cloudflare.D1.Database("Database", { migrations });
+/**
+ * Resolved runs and installation tokens, shared by every isolate of the
+ * Worker. Everything in it is re-derivable from GitHub; see `KVCache.ts`.
+ */
+export const Cache = Cloudflare.KV.Namespace("Cache");
+//# sourceMappingURL=Bindings.js.map

package/dist/Registry/Bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Bindings.js","sourceRoot":"","sources":["../../src/Registry/Bindings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAClC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,kBAAkB;IAC9B,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,kBAAkB,CAAC;CAC9D,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM;IACd;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;IACpD,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;CACH,CAAC,CAAC;AAmBH;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAMhD,CAAC,iCAAiC,CAAC;CAAG;AAEzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAE9C,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAE7D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjD,uEAAuE;AACvE,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE,CACzD,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC;AAE9C,2EAA2E;AAC3E,wEAAwE;AACxE,0DAA0D;AAC1D,MAAM,UAAU,GACd,OAAO,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;IACxE,CAAC,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC,CAAC,SAAS,CAAC;AAEhB,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC"}

package/dist/Registry/GitHub.d.ts

@@ -0,0 +1,96 @@
+import * as Github from "@distilled.cloud/github";
+import * as Actions from "@distilled.cloud/github/actions";
+import * as Apps from "@distilled.cloud/github/apps";
+import * as Checks from "@distilled.cloud/github/checks";
+import * as Issues from "@distilled.cloud/github/issues";
+import * as Pulls from "@distilled.cloud/github/pulls";
+import * as Repos from "@distilled.cloud/github/repos";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as crypto from "node:crypto";
+import { RegistryConfig } from "./Bindings.ts";
+declare const CryptoError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "CryptoError";
+} & Readonly<A>;
+export declare class CryptoError extends CryptoError_base<{
+    readonly message: string;
+}> {
+}
+declare const AppNotInstalled_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AppNotInstalled";
+} & Readonly<A>;
+export declare class AppNotInstalled extends AppNotInstalled_base<{
+    readonly repo: string;
+}> {
+    get message(): string;
+}
+/** Import an RSA private key PEM (PKCS#1 or PKCS#8) for RS256 signing. */
+export declare const importPrivateKey: (pem: string) => Effect.Effect<crypto.KeyObject, CryptoError, never>;
+/** Sign a compact RS256 JWT, used to authenticate as the GitHub App. */
+export declare const signJwt: (claims: Record<string, unknown>, key: crypto.KeyObject) => Effect.Effect<string, CryptoError, never>;
+/**
+ * Install commands per package, grouped. A group marked `collapsed`
+ * renders as a closed `<details>` block so a long list of secondary
+ * packages stays out of the way.
+ */
+export declare const renderInstalls: (packages: ReadonlyArray<{
+    name: string;
+    group: string;
+    url: string;
+}>, groups: ReadonlyArray<{
+    name: string;
+    collapsed: boolean;
+}>) => string;
+export declare const renderComment: (packages: ReadonlyArray<{
+    name: string;
+    group: string;
+    url: string;
+}>, groups: ReadonlyArray<{
+    name: string;
+    collapsed: boolean;
+}>, times: {
+    readonly publishedAt: number;
+    readonly expiresAt: number;
+}) => string;
+/** Render any GitHub operation failure for logs and error responses. */
+export declare const describe: (error: {
+    readonly _tag: string;
+    readonly message?: string | undefined;
+}) => string;
+declare const GitHubApp_base: Context.ServiceClass<GitHubApp, "@alchemy.run/pkg/GitHubApp", {
+    getRun: (repo: string, runId: number) => Effect.Effect<Actions.WorkflowRun, AppNotInstalled | import("effect/Config").ConfigError | CryptoError | Apps.Forbidden | Apps.NotFound | Apps.UnprocessableEntity | Github.GithubOpError, import("alchemy/Cloudflare/Providers").Providers | import("alchemy/Cloudflare/KV/ReadWriteNamespace").ReadWriteNamespace | import("alchemy").RuntimeContext>;
+    /**
+     * Artifacts named `name` uploaded to a run so far, including by jobs
+     * still in progress.
+     */
+    listRunArtifacts: (repo: string, runId: number, name: string) => Effect.Effect<Actions.ListWorkflowRunArtifactsResponseArtifactsList, AppNotInstalled | import("effect/Config").ConfigError | CryptoError | Apps.Forbidden | Apps.NotFound | Apps.UnprocessableEntity | Github.GithubOpError, import("alchemy/Cloudflare/Providers").Providers | import("alchemy/Cloudflare/KV/ReadWriteNamespace").ReadWriteNamespace | import("alchemy").RuntimeContext>;
+    /**
+     * Pull requests against `repo` whose head is `sha` in `headRepo`, the
+     * repository the commit was pushed to.
+     */
+    pullRequestsForCommit: (repo: string, headRepo: string, sha: string) => Effect.Effect<Repos.PullRequestSimple[], AppNotInstalled | import("effect/Config").ConfigError | CryptoError | Apps.Forbidden | Apps.NotFound | Apps.UnprocessableEntity | Repos.ListPullRequestsAssociatedWithCommitError, import("alchemy/Cloudflare/Providers").Providers | import("alchemy/Cloudflare/KV/ReadWriteNamespace").ReadWriteNamespace | import("alchemy").RuntimeContext>;
+    getPullRequest: (repo: string, number: number) => Effect.Effect<Pulls.PullRequest, AppNotInstalled | import("effect/Config").ConfigError | CryptoError | Apps.Forbidden | Apps.NotFound | Apps.UnprocessableEntity | Pulls.GetError, import("alchemy/Cloudflare/Providers").Providers | import("alchemy/Cloudflare/KV/ReadWriteNamespace").ReadWriteNamespace | import("alchemy").RuntimeContext>;
+    /**
+     * Publish a completed check run on `headSha`. GitHub shows the newest run
+     * per name and App, so re-publishing the same commit simply supersedes it.
+     */
+    createCheckRun: (repo: string, input: {
+        readonly headSha: string;
+        readonly name: string;
+        readonly title: string;
+        readonly summary: string;
+        readonly detailsUrl: string;
+    }) => Effect.Effect<Checks.CheckRun, AppNotInstalled | import("effect/Config").ConfigError | CryptoError | Apps.Forbidden | Apps.NotFound | Apps.UnprocessableEntity | Github.GithubOpError, import("alchemy/Cloudflare/Providers").Providers | import("alchemy/Cloudflare/KV/ReadWriteNamespace").ReadWriteNamespace | import("alchemy").RuntimeContext>;
+    /**
+     * Create or update the comment on `issue` whose body starts with
+     * `marker`, looking through the first five pages of comments.
+     */
+    upsertComment: (repo: string, issue: number, marker: string, body: string) => Effect.Effect<void, AppNotInstalled | Github.BadGateway | import("effect/Config").ConfigError | Github.ConfigError | CryptoError | Apps.Forbidden | Issues.Forbidden | Github.GatewayTimeout | Github.GithubParseError | Github.Gone | Issues.Gone | import("effect/unstable/http/HttpClientError").HttpClientError | Github.InternalServerError | Apps.NotFound | Issues.NotFound | Github.ServiceUnavailable | Github.TooManyRequests | Github.Unauthorized | Github.UnknownGithubError | Apps.UnprocessableEntity | Issues.UnprocessableEntity, import("alchemy/Cloudflare/Providers").Providers | import("alchemy/Cloudflare/KV/ReadWriteNamespace").ReadWriteNamespace | import("alchemy").RuntimeContext>;
+}>;
+export declare class GitHubApp extends GitHubApp_base {
+}
+export declare const GitHubAppLive: Layer.Layer<GitHubApp, never, HttpClient.HttpClient | RegistryConfig>;
+export {};
+//# sourceMappingURL=GitHub.d.ts.map