@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/dist/modules/database/connection.d.ts

@@ -1,6 +1,71 @@
 import * as schema from './schema.js';
-export declare function getDb(databaseUrl: string): import("drizzle-orm/node-postgres").NodePgDatabase<typeof schema> & {
+/**
+ * One database, one schema per knowledge base.
+ *
+ * A single-tenant deployment keeps `public`, exactly as before this option
+ * existed: no `search_path` is set for it, so an operator's own default
+ * (`"$user", public`) is honoured, and the migration ledger stays where
+ * drizzle put it. A knowledge base hosted beside others gets a schema of its
+ * own: every connection of its pool starts with `search_path` pointing at it,
+ * so the unqualified table names the schema module and the migrations use
+ * resolve there and nowhere else. Isolation is then a Postgres object, and a
+ * tenant leaves as `pg_dump -n <schema>`.
+ */
+export declare const DEFAULT_DB_SCHEMA = "public";
+/**
+ * A schema name this module will put into `search_path`: a plain lowercase
+ * identifier, at most Postgres's 63 characters. Validated rather than quoted,
+ * because the name also travels into `CREATE SCHEMA` and a `pg_dump`
+ * invocation, and a name that needs quoting in one of them is a name that
+ * will be spelled wrong in another.
+ */
+export declare function assertSchemaName(name: string): string;
+/**
+ * Prove that this handle's connections really search `schema` first, by
+ * asking the server. The schema is set as a startup parameter, and a
+ * transaction- or statement-mode pooler in front of the database (PgBouncer
+ * in those modes, RDS Proxy) either refuses that parameter or resets it
+ * between transactions; every unqualified table name would then resolve to
+ * `public`, and tenants would read each other's rows without a single
+ * error. So a graph refuses to come up on a handle that lost its schema,
+ * which is the failure an operator can see. Only session pooling is
+ * supported in front of a process that serves several knowledge bases.
+ */
+export declare function assertSearchPath(db: Pick<Database, 'execute'>, schema: string): Promise<void>;
+export interface DbOptions {
+    /** The schema the pool's connections search first. Default {@link DEFAULT_DB_SCHEMA}. */
+    schema?: string;
+    /**
+     * Connections the pool may hold. `pg`'s default (10) suits a process that
+     * serves one knowledge base; a process serving many keeps each pool small,
+     * since the database's `max_connections` is shared by all of them.
+     */
+    max?: number;
+    /** How long an idle connection is kept before the pool closes it. Default: `pg`'s. */
+    idleTimeoutMillis?: number;
+}
+/**
+ * A NEW pool on `databaseUrl`, searching `opts.schema` first. Not cached:
+ * the caller owns it and ends it with {@link closeDb}. The composition root
+ * of a process that serves one knowledge base goes through {@link getDb}
+ * instead, which caches.
+ */
+export declare function createDb(databaseUrl: string, opts?: DbOptions): import("drizzle-orm/node-postgres").NodePgDatabase<typeof schema> & {
     $client: import("pg").Pool;
 };
-export type Database = ReturnType<typeof getDb>;
+export type Database = ReturnType<typeof createDb>;
+/** The schema a database handle searches first — for the callers that name it in DDL. */
+export declare function dbSchemaOf(db: Pick<Database, '$client'>): string;
+/**
+ * The process's pool on `databaseUrl` for `opts.schema`, created on first
+ * use and shared afterwards. One per (url, schema): two handles on the same
+ * schema would be two pools competing for the same connection budget.
+ */
+export declare function getDb(databaseUrl: string, opts?: DbOptions): Database;
+/**
+ * End a handle's pool and forget it, so a later {@link getDb} for the same
+ * schema opens a fresh one rather than handing out a pool that was ended.
+ * The last step of stopping a knowledge base's graph.
+ */
+export declare function closeDb(db: Pick<Database, '$client'>): Promise<void>;
 //# sourceMappingURL=connection.d.ts.map

package/dist/modules/database/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAItC,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM;;EAcxC;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnG;AAED,MAAM,WAAW,SAAS;IACxB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAcD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc;;EAgBjE;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEnD,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,CAEhE;AAOD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc,GAAG,QAAQ,CASzE;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E"}

package/dist/modules/database/connection.js

@@ -1,20 +1,126 @@
+import { sql } from 'drizzle-orm';
 import { drizzle } from 'drizzle-orm/node-postgres';
 import pg from 'pg';
 import * as schema from './schema.js';
-let db = null;
-export function getDb(databaseUrl) {
+/**
+ * One database, one schema per knowledge base.
+ *
+ * A single-tenant deployment keeps `public`, exactly as before this option
+ * existed: no `search_path` is set for it, so an operator's own default
+ * (`"$user", public`) is honoured, and the migration ledger stays where
+ * drizzle put it. A knowledge base hosted beside others gets a schema of its
+ * own: every connection of its pool starts with `search_path` pointing at it,
+ * so the unqualified table names the schema module and the migrations use
+ * resolve there and nowhere else. Isolation is then a Postgres object, and a
+ * tenant leaves as `pg_dump -n <schema>`.
+ */
+export const DEFAULT_DB_SCHEMA = 'public';
+/**
+ * A schema name this module will put into `search_path`: a plain lowercase
+ * identifier, at most Postgres's 63 characters. Validated rather than quoted,
+ * because the name also travels into `CREATE SCHEMA` and a `pg_dump`
+ * invocation, and a name that needs quoting in one of them is a name that
+ * will be spelled wrong in another.
+ */
+export function assertSchemaName(name) {
+    if (!/^[a-z][a-z0-9_]{0,62}$/.test(name)) {
+        throw new Error(`Database schema name must be a lowercase identifier ([a-z][a-z0-9_]*, at most 63 characters); got "${name}"`);
+    }
+    // Names Postgres or drizzle already own. `pg_*` would fail at CREATE
+    // SCHEMA anyway; `information_schema` would not, and `drizzle` is where a
+    // deployment on the default schema keeps its migration ledger, so a
+    // knowledge base placed there would share that ledger's home.
+    if (name.startsWith('pg_') || name === 'information_schema' || name === 'drizzle') {
+        throw new Error(`Database schema name "${name}" is reserved`);
+    }
+    return name;
+}
+/**
+ * Prove that this handle's connections really search `schema` first, by
+ * asking the server. The schema is set as a startup parameter, and a
+ * transaction- or statement-mode pooler in front of the database (PgBouncer
+ * in those modes, RDS Proxy) either refuses that parameter or resets it
+ * between transactions; every unqualified table name would then resolve to
+ * `public`, and tenants would read each other's rows without a single
+ * error. So a graph refuses to come up on a handle that lost its schema,
+ * which is the failure an operator can see. Only session pooling is
+ * supported in front of a process that serves several knowledge bases.
+ */
+export async function assertSearchPath(db, schema) {
+    const result = await db.execute(sql `select current_schema() as schema`);
+    const current = result.rows[0]?.schema ?? null;
+    if (current !== schema) {
+        throw new Error(`Database connections search "${current ?? '(none)'}" first, not the configured schema "${schema}". ` +
+            'A transaction-mode pooler in front of Postgres drops the search_path startup parameter; ' +
+            'use session pooling, or connect directly.');
+    }
+}
+/**
+ * A bounded handshake: `pg` waits forever by default for a NEW connection to
+ * come up, so a database that accepts the socket and never finishes the
+ * handshake would hold a boot (the migration lock is the first thing that
+ * asks) with nothing to say and nothing for the restart policy to see. Half
+ * a minute is generous for a handshake and short enough for a failed boot to
+ * be visible. It bounds only that: a checkout queued behind a saturated pool,
+ * or a query on a connection that stopped answering, is the caller's to
+ * bound — the advisory lock does.
+ */
+const CONNECT_TIMEOUT_MS = 30_000;
+/**
+ * A NEW pool on `databaseUrl`, searching `opts.schema` first. Not cached:
+ * the caller owns it and ends it with {@link closeDb}. The composition root
+ * of a process that serves one knowledge base goes through {@link getDb}
+ * instead, which caches.
+ */
+export function createDb(databaseUrl, opts = {}) {
+    const dbSchema = assertSchemaName(opts.schema ?? DEFAULT_DB_SCHEMA);
+    const pool = new pg.Pool({
+        connectionString: databaseUrl,
+        connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+        max: opts.max,
+        idleTimeoutMillis: opts.idleTimeoutMillis,
+        // A startup parameter, applied by the server to every connection this
+        // pool opens — not a `SET` run after connecting, which a pooled
+        // connection could outlive. The default schema sets nothing, so an
+        // operator's own `search_path` stays in force there.
+        ...(dbSchema === DEFAULT_DB_SCHEMA ? {} : { options: `-c search_path=${dbSchema}` }),
+    });
+    const db = drizzle(pool, { schema });
+    schemas.set(db, dbSchema);
+    return db;
+}
+/** The schema a database handle searches first — for the callers that name it in DDL. */
+export function dbSchemaOf(db) {
+    return schemas.get(db) ?? DEFAULT_DB_SCHEMA;
+}
+const schemas = new WeakMap();
+const cache = new Map();
+const cacheKey = (databaseUrl, dbSchema) => `${dbSchema}\u0000${databaseUrl}`;
+/**
+ * The process's pool on `databaseUrl` for `opts.schema`, created on first
+ * use and shared afterwards. One per (url, schema): two handles on the same
+ * schema would be two pools competing for the same connection budget.
+ */
+export function getDb(databaseUrl, opts = {}) {
+    const dbSchema = assertSchemaName(opts.schema ?? DEFAULT_DB_SCHEMA);
+    const key = cacheKey(databaseUrl, dbSchema);
+    let db = cache.get(key);
     if (!db) {
-        // A bounded handshake: `pg` waits forever by default for a NEW connection
-        // to come up, so a database that accepts the socket and never finishes
-        // the handshake would hold a boot (the migration lock is the first thing
-        // that asks) with nothing to say and nothing for the restart policy to
-        // see. Half a minute is generous for a handshake and short enough for a
-        // failed boot to be visible. It bounds only that: a checkout queued
-        // behind a saturated pool, or a query on a connection that stopped
-        // answering, is the caller's to bound — the advisory lock does.
-        const pool = new pg.Pool({ connectionString: databaseUrl, connectionTimeoutMillis: 30_000 });
-        db = drizzle(pool, { schema });
+        db = createDb(databaseUrl, opts);
+        cache.set(key, db);
     }
     return db;
 }
+/**
+ * End a handle's pool and forget it, so a later {@link getDb} for the same
+ * schema opens a fresh one rather than handing out a pool that was ended.
+ * The last step of stopping a knowledge base's graph.
+ */
+export async function closeDb(db) {
+    for (const [key, cached] of cache) {
+        if (cached === db)
+            cache.delete(key);
+    }
+    await db.$client.end();
+}
 //# sourceMappingURL=connection.js.map

package/dist/modules/database/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,IAAI,EAAE,GAAqD,IAAI,CAAC;AAEhE,MAAM,UAAU,KAAK,CAAC,WAAmB;IACvC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,sGAAsG,IAAI,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,eAAe,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAA6B,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mCAAmC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAqC,EAAE,MAAM,IAAI,IAAI,CAAC;IACpF,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,IAAI,QAAQ,uCAAuC,MAAM,KAAK;YACnG,0FAA0F;YAC1F,2CAA2C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,OAAkB,EAAE;IAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;QACvB,gBAAgB,EAAE,WAAW;QAC7B,uBAAuB,EAAE,kBAAkB;QAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,sEAAsE;QACtE,gEAAgE;QAChE,mEAAmE;QACnE,qDAAqD;QACrD,GAAG,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,QAAQ,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC;AACZ,CAAC;AAID,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,EAA6B;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,EAAc,CAAC,IAAI,iBAAiB,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAoB,CAAC;AAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAE,QAAgB,EAAE,EAAE,CAAC,GAAG,QAAQ,SAAS,WAAW,EAAE,CAAC;AAE9F;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,WAAmB,EAAE,OAAkB,EAAE;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAA6B;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AACzB,CAAC"}

package/dist/modules/database/migrate.d.ts

@@ -1,4 +1,4 @@
-import type { Database } from './connection.js';
+import { type Database } from './connection.js';
 /** Apply the CORE migration history from `folder`, tracked in `__drizzle_migrations_core`. */
 export declare function runCoreMigrations(db: Database, folder: string): Promise<void>;
 /**

package/dist/modules/database/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAoChD,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASzF"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiC,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAyD/E,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYnF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBzF"}

package/dist/modules/database/migrate.js

@@ -1,6 +1,7 @@
 import { migrate } from 'drizzle-orm/node-postgres/migrator';
 import { logger } from '../../shared/logging.js';
 const log = logger('database');
+import { DEFAULT_DB_SCHEMA, dbSchemaOf } from './connection.js';
 import { AdvisoryLock, withAdvisoryLock } from './advisory-lock.js';
 /*
  * ── Per-tier migration folders ──────────────────────────────────────────────
@@ -34,13 +35,34 @@ import { AdvisoryLock, withAdvisoryLock } from './advisory-lock.js';
  * is not hypothetical here — it is every redeploy, for as long as the outgoing
  * container takes to exit. See `advisory-lock.ts` for the mechanism.
  */
+/**
+ * Where a handle's migration ledger lives, and which lock guards its runs.
+ *
+ * The default schema keeps drizzle's own `drizzle` schema for the ledger,
+ * where every existing deployment already has one: naming `public` here
+ * would make the next boot read an empty ledger and re-apply plain DDL that
+ * is already applied. A knowledge base on a schema of its own keeps its
+ * ledger IN that schema, so the schema is the whole of the tenant: what
+ * `pg_dump -n` carries out includes what has been applied to it, and the
+ * dedicated deployment it is restored into resumes from there rather than
+ * from nothing. The lock is keyed the same way, so two tenants of one
+ * database migrate side by side while two processes of one tenant still
+ * take turns.
+ */
+function ledgerOptions(db) {
+    const schema = dbSchemaOf(db);
+    return schema === DEFAULT_DB_SCHEMA
+        ? { tenantKey: '' }
+        : { migrationsSchema: schema, tenantKey: schema };
+}
 /** Apply the CORE migration history from `folder`, tracked in `__drizzle_migrations_core`. */
 export async function runCoreMigrations(db, folder) {
+    const { migrationsSchema, tenantKey } = ledgerOptions(db);
     await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
         log.info('Running core database migrations...');
-        await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core' });
+        await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core', migrationsSchema });
         log.info('Core migrations complete.');
-    });
+    }, { tenantKey });
 }
 /**
  * Apply the ENTERPRISE migration history from `folder`, tracked in
@@ -48,13 +70,15 @@ export async function runCoreMigrations(db, folder) {
  * enterprise tables FK into core tables.
  */
 export async function runEnterpriseMigrations(db, folder) {
+    const { migrationsSchema, tenantKey } = ledgerOptions(db);
     await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
         log.info('Running enterprise database migrations...');
         await migrate(db, {
             migrationsFolder: folder,
             migrationsTable: '__drizzle_migrations_enterprise',
+            migrationsSchema,
         });
         log.info('Enterprise migrations complete.');
-    });
+    }, { tenantKey });
 }
 //# sourceMappingURL=migrate.js.map

package/dist/modules/database/migrate.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,MAAc;IAClE,MAAM,gBAAgB,CAAC,EAAE,EAAE,YAAY,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QAC7D,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC9F,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,MAAc;IACxE,MAAM,gBAAgB,CAAC,EAAE,EAAE,YAAY,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QAC7D,GAAG,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,EAAE,EAAE;YAChB,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,iCAAiC;SACnD,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAiB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,MAAM,KAAK,iBAAiB;QACjC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACnB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,MAAc;IAClE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,gBAAgB,CACpB,EAAE,EACF,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAChH,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,CAAC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,MAAc;IACxE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,gBAAgB,CACpB,EAAE,EACF,YAAY,CAAC,UAAU,EACvB,KAAK,IAAI,EAAE;QACT,GAAG,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,EAAE,EAAE;YAChB,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,iCAAiC;YAClD,gBAAgB;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;AACJ,CAAC"}

package/dist/modules/github-app/github-app.client.d.ts

@@ -0,0 +1,101 @@
+/** A GitHub App's identity and keys, as GitHub issued them. */
+export interface GitHubAppCredentials {
+    appId: string;
+    slug: string;
+    /** PEM. */
+    privateKey: string;
+    clientId: string;
+    clientSecret: string;
+}
+/** What GitHub hands back when an app is created from a manifest. */
+export interface RegisteredApp extends GitHubAppCredentials {
+    /** The account that owns the app. */
+    owner: string;
+    htmlUrl: string;
+}
+export interface Installation {
+    id: string;
+    /** The user or organisation it is installed on. */
+    account: string;
+    /** `all`, or `selected` when the admin chose repositories. */
+    repositorySelection: string;
+}
+export interface InstallationToken {
+    token: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+}
+export interface InstallationRepository {
+    /** `owner/name`. */
+    fullName: string;
+    private: boolean;
+    defaultBranch: string;
+    /** Whether the installation may push to it. */
+    writable: boolean;
+}
+export type GitHubFailureKind = 'unreachable' | 'refused' | 'not-found' | 'unexpected';
+/** A call to GitHub that did not give what was asked. The message never carries a credential. */
+export declare class GitHubAppError extends Error {
+    readonly kind: GitHubFailureKind;
+    readonly status: number;
+    constructor(kind: GitHubFailureKind, message: string, status?: number);
+}
+/**
+ * A private key as an operator is likely to have supplied it: the PEM
+ * itself, the PEM with its line breaks written as `\n` (the only way most
+ * environment files can hold it), or the PEM in base64.
+ */
+export declare function normalizePrivateKey(raw: string): string;
+/**
+ * The JWT an app presents to GitHub as itself: RS256 over its id, good for
+ * a few minutes. Issued a minute in the past, as GitHub advises, so a clock
+ * that runs slightly ahead of theirs is not refused.
+ */
+export declare function appJwt(credentials: Pick<GitHubAppCredentials, 'appId' | 'privateKey'>, now?: number): string;
+/**
+ * What the deployment asks of GitHub, as a GitHub App: every call it makes,
+ * and nothing that decides anything. Injected with `fetch` so suites answer
+ * for GitHub.
+ */
+export declare class GitHubAppClient {
+    private readonly fetchImpl;
+    private readonly now;
+    /** How long one request to GitHub may take. */
+    private readonly timeoutMs;
+    constructor(fetchImpl?: typeof fetch, now?: () => number, 
+    /** How long one request to GitHub may take. */
+    timeoutMs?: number);
+    /** The app GitHub created from a manifest, for the code it sent the browser back with. Good once, for an hour. */
+    convertManifest(code: string): Promise<RegisteredApp>;
+    /**
+     * A token for the PERSON who has just come back from GitHub, in exchange
+     * for the code they came back with. Used for one question (see
+     * {@link installationsOf}) and then dropped.
+     */
+    exchangeUserCode(credentials: Pick<GitHubAppCredentials, 'clientId' | 'clientSecret'>, code: string): Promise<string>;
+    /** The installations of this app that the person holding `userToken` can reach. */
+    installationsOf(userToken: string): Promise<Installation[]>;
+    /** One installation, asked for as the app. */
+    installation(credentials: GitHubAppCredentials, id: string): Promise<Installation>;
+    /** A token for the installation: what git presents. Good for an hour. */
+    installationToken(credentials: GitHubAppCredentials, id: string): Promise<InstallationToken>;
+    /** The repositories the installation reaches, and whether the list was cut short. */
+    repositories(installationToken: string): Promise<{
+        repositories: InstallationRepository[];
+        more: boolean;
+    }>;
+    /**
+     * The repositories of an installation that THE PERSON holding `userToken`
+     * reaches, each with that person's own permissions: `writable` is whether
+     * they may push to it, which is another question from whether the
+     * installation may. An installation the person does not reach at all is
+     * GitHub's to refuse.
+     */
+    repositoriesOf(userToken: string, installationId: string): Promise<{
+        repositories: InstallationRepository[];
+        more: boolean;
+    }>;
+    private listRepositories;
+    private call;
+}
+//# sourceMappingURL=github-app.client.d.ts.map

package/dist/modules/github-app/github-app.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.client.d.ts","sourceRoot":"","sources":["../../../src/modules/github-app/github-app.client.ts"],"names":[],"mappings":"AAEA,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACzD,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEvF,iGAAiG;AACjG,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,iBAAiB;IAEhC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,iBAAiB,EAChC,OAAO,EAAE,MAAM,EACN,MAAM,SAAI;CAKtB;AAUD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUvD;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,GAAG,YAAY,CAAC,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAYxH;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,+CAA+C;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAHT,SAAS,GAAE,OAAO,KAAa,EAC/B,GAAG,GAAE,MAAM,MAAiB;IAC7C,+CAA+C;IAC9B,SAAS,GAAE,MAA2B;IAGzD,kHAAkH;IAC5G,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAoB3D;;;;OAIG;IACG,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa3H,mFAAmF;IAC7E,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAajE,8CAA8C;IACxC,YAAY,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAOxF,yEAAyE;IACnE,iBAAiB,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAYlG,qFAAqF;IACrF,YAAY,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAI3G;;;;;;OAMG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;YAI/G,gBAAgB;YA0BhB,IAAI;CA4BnB"}

package/dist/modules/github-app/github-app.client.js

@@ -0,0 +1,222 @@
+import { createSign } from 'node:crypto';
+/** A call to GitHub that did not give what was asked. The message never carries a credential. */
+export class GitHubAppError extends Error {
+    kind;
+    status;
+    constructor(kind, message, status = 0) {
+        super(message);
+        this.kind = kind;
+        this.status = status;
+        this.name = 'GitHubAppError';
+    }
+}
+const API = 'https://api.github.com';
+const WEB = 'https://github.com';
+const API_VERSION = '2022-11-28';
+/** Generous for an API that answers in a fraction of a second, short for something git is waiting on. */
+const REQUEST_TIMEOUT_MS = 10_000;
+/** Repositories listed per installation before the list is said to be cut short. */
+const MAX_REPOSITORIES = 500;
+/**
+ * A private key as an operator is likely to have supplied it: the PEM
+ * itself, the PEM with its line breaks written as `\n` (the only way most
+ * environment files can hold it), or the PEM in base64.
+ */
+export function normalizePrivateKey(raw) {
+    const value = raw.trim();
+    if (value.includes('-----BEGIN'))
+        return value.replace(/\\n/g, '\n');
+    try {
+        const decoded = Buffer.from(value, 'base64').toString('utf8');
+        if (decoded.includes('-----BEGIN'))
+            return decoded.trim();
+    }
+    catch {
+        // Not base64: handed on as it is, and the signing says what is wrong with it.
+    }
+    return value;
+}
+/**
+ * The JWT an app presents to GitHub as itself: RS256 over its id, good for
+ * a few minutes. Issued a minute in the past, as GitHub advises, so a clock
+ * that runs slightly ahead of theirs is not refused.
+ */
+export function appJwt(credentials, now = Date.now()) {
+    const seconds = Math.floor(now / 1000);
+    const part = (value) => Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+    const body = `${part({ alg: 'RS256', typ: 'JWT' })}.${part({ iat: seconds - 60, exp: seconds + 9 * 60, iss: credentials.appId })}`;
+    let signature;
+    try {
+        signature = createSign('RSA-SHA256').update(body).end().sign(normalizePrivateKey(credentials.privateKey), 'base64url');
+    }
+    catch {
+        // What the key was is never quoted.
+        throw new GitHubAppError('refused', 'The GitHub App private key could not be read. It must be the PEM GitHub issued.');
+    }
+    return `${body}.${signature}`;
+}
+/**
+ * What the deployment asks of GitHub, as a GitHub App: every call it makes,
+ * and nothing that decides anything. Injected with `fetch` so suites answer
+ * for GitHub.
+ */
+export class GitHubAppClient {
+    fetchImpl;
+    now;
+    timeoutMs;
+    constructor(fetchImpl = fetch, now = Date.now, 
+    /** How long one request to GitHub may take. */
+    timeoutMs = REQUEST_TIMEOUT_MS) {
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+        this.timeoutMs = timeoutMs;
+    }
+    /** The app GitHub created from a manifest, for the code it sent the browser back with. Good once, for an hour. */
+    async convertManifest(code) {
+        const body = await this.call(`${API}/app-manifests/${encodeURIComponent(code)}/conversions`, {
+            method: 'POST',
+        });
+        const owner = body.owner?.login;
+        const app = {
+            appId: String(body.id ?? ''),
+            slug: String(body.slug ?? ''),
+            privateKey: String(body.pem ?? ''),
+            clientId: String(body.client_id ?? ''),
+            clientSecret: String(body.client_secret ?? ''),
+            owner: typeof owner === 'string' ? owner : '',
+            htmlUrl: String(body.html_url ?? ''),
+        };
+        if (!app.appId || !app.slug || !app.privateKey || !app.clientId || !app.clientSecret) {
+            throw new GitHubAppError('unexpected', 'GitHub created the app but did not return its keys.');
+        }
+        return app;
+    }
+    /**
+     * A token for the PERSON who has just come back from GitHub, in exchange
+     * for the code they came back with. Used for one question (see
+     * {@link installationsOf}) and then dropped.
+     */
+    async exchangeUserCode(credentials, code) {
+        const body = await this.call(`${WEB}/login/oauth/access_token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ client_id: credentials.clientId, client_secret: credentials.clientSecret, code }),
+        });
+        // GitHub answers a refused exchange with 200 and an `error` field.
+        if (typeof body.access_token !== 'string' || !body.access_token) {
+            throw new GitHubAppError('refused', 'GitHub did not accept the sign-in that came back with the installation.');
+        }
+        return body.access_token;
+    }
+    /** The installations of this app that the person holding `userToken` can reach. */
+    async installationsOf(userToken) {
+        const found = [];
+        for (let page = 1; page <= 10; page += 1) {
+            const body = await this.call(`${API}/user/installations?per_page=100&page=${page}`, {
+                headers: { Authorization: `Bearer ${userToken}` },
+            });
+            const batch = Array.isArray(body.installations) ? body.installations : [];
+            for (const item of batch)
+                found.push(installationOf(item));
+            if (batch.length < 100)
+                break;
+        }
+        return found;
+    }
+    /** One installation, asked for as the app. */
+    async installation(credentials, id) {
+        const body = await this.call(`${API}/app/installations/${encodeURIComponent(id)}`, {
+            headers: { Authorization: `Bearer ${appJwt(credentials, this.now())}` },
+        });
+        return installationOf(body);
+    }
+    /** A token for the installation: what git presents. Good for an hour. */
+    async installationToken(credentials, id) {
+        const body = await this.call(`${API}/app/installations/${encodeURIComponent(id)}/access_tokens`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${appJwt(credentials, this.now())}` },
+        });
+        const expiresAt = Date.parse(String(body.expires_at ?? ''));
+        if (typeof body.token !== 'string' || !body.token || Number.isNaN(expiresAt)) {
+            throw new GitHubAppError('unexpected', 'GitHub did not return a token for the installation.');
+        }
+        return { token: body.token, expiresAt };
+    }
+    /** The repositories the installation reaches, and whether the list was cut short. */
+    repositories(installationToken) {
+        return this.listRepositories(`${API}/installation/repositories`, installationToken);
+    }
+    /**
+     * The repositories of an installation that THE PERSON holding `userToken`
+     * reaches, each with that person's own permissions: `writable` is whether
+     * they may push to it, which is another question from whether the
+     * installation may. An installation the person does not reach at all is
+     * GitHub's to refuse.
+     */
+    repositoriesOf(userToken, installationId) {
+        return this.listRepositories(`${API}/user/installations/${encodeURIComponent(installationId)}/repositories`, userToken);
+    }
+    async listRepositories(url, token) {
+        const repositories = [];
+        let total = 0;
+        for (let page = 1; repositories.length < MAX_REPOSITORIES; page += 1) {
+            const body = await this.call(`${url}?per_page=100&page=${page}`, { headers: { Authorization: `Bearer ${token}` } });
+            total = typeof body.total_count === 'number' ? body.total_count : total;
+            const batch = Array.isArray(body.repositories) ? body.repositories : [];
+            for (const item of batch) {
+                const repo = item;
+                if (typeof repo.full_name !== 'string')
+                    continue;
+                repositories.push({
+                    fullName: repo.full_name,
+                    private: repo.private === true,
+                    defaultBranch: typeof repo.default_branch === 'string' ? repo.default_branch : '',
+                    writable: repo.permissions?.push === true,
+                });
+            }
+            if (batch.length < 100)
+                break;
+        }
+        repositories.sort((a, b) => a.fullName.localeCompare(b.fullName));
+        return { repositories, more: total > repositories.length };
+    }
+    async call(url, init) {
+        let res;
+        try {
+            res = await this.fetchImpl(url, {
+                ...init,
+                // A deadline of ours: left to the platform, a host that accepts
+                // the connection and says nothing is waited on for minutes, by
+                // whatever was waiting on this call.
+                signal: AbortSignal.timeout(this.timeoutMs),
+                headers: {
+                    Accept: 'application/vnd.github+json',
+                    'X-GitHub-Api-Version': API_VERSION,
+                    'User-Agent': 'hexis',
+                    ...init.headers,
+                },
+            });
+        }
+        catch (err) {
+            throw new GitHubAppError('unreachable', `GitHub could not be reached: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!res.ok) {
+            // GitHub's own words name the cause (a permission, a suspended app) and carry no credential of ours.
+            const said = (await res.json().catch(() => ({}))).message;
+            const detail = typeof said === 'string' && said ? `: ${said.slice(0, 200)}` : '';
+            const kind = res.status === 404 ? 'not-found' : res.status === 401 || res.status === 403 ? 'refused' : 'unexpected';
+            throw new GitHubAppError(kind, `GitHub answered ${res.status}${detail}`, res.status);
+        }
+        return (await res.json().catch(() => ({})));
+    }
+}
+function installationOf(raw) {
+    const item = (raw ?? {});
+    const account = item.account?.login;
+    return {
+        id: String(item.id ?? ''),
+        account: typeof account === 'string' ? account : '',
+        repositorySelection: typeof item.repository_selection === 'string' ? item.repository_selection : '',
+    };
+}
+//# sourceMappingURL=github-app.client.js.map