@framers/agentos-ext-github 0.1.5 → 0.2.1

package/dist/app/http.js

@@ -0,0 +1,128 @@
+/**
+ * @fileoverview GitHub's REST API over an injected `fetch`: one call with the headers every call carries, the pages
+ * of a listing followed through its `Link` header, and the small readers that turn an answer into typed fields. An
+ * answer outside 2xx throws {@link GitHubApiError}, whose message names the status and nothing of the answer's body.
+ * @module agentos-ext-github/app/http
+ */
+/** The REST API version every call pins (`X-GitHub-Api-Version`). */
+export const GITHUB_API_VERSION = '2026-03-10';
+/** GitHub's REST API. */
+export const GITHUB_API_BASE = 'https://api.github.com';
+/** GitHub answered a status outside 2xx. The message holds the status alone, never the answer's body. */
+export class GitHubApiError extends Error {
+    status;
+    /** @param status The HTTP status GitHub answered. */
+    constructor(status) {
+        super(`GitHub answered ${status}`);
+        this.status = status;
+        this.name = 'GitHubApiError';
+    }
+}
+/** The headers of a call: the bearer, the media type, the pinned API version and the pack's user agent. */
+export function githubHeaders(token, accept = 'application/vnd.github+json') {
+    return {
+        authorization: `Bearer ${token}`,
+        accept,
+        'x-github-api-version': GITHUB_API_VERSION,
+        'user-agent': 'agentos-ext-github',
+    };
+}
+/** Releases an answer's body unread. */
+export async function discardBody(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        // The body is not needed; a failed cancel changes nothing for the caller.
+    }
+}
+/** Sends one call; an answer outside 2xx is discarded and thrown as {@link GitHubApiError}. */
+export async function githubSend(fetchImpl, url, request) {
+    const headers = githubHeaders(request.token, request.accept);
+    if (request.body !== undefined)
+        headers['content-type'] = 'application/json';
+    const response = await fetchImpl(url, { method: request.method ?? 'GET', headers, body: request.body, signal: request.signal });
+    if (!response.ok) {
+        await discardBody(response);
+        throw new GitHubApiError(response.status);
+    }
+    return response;
+}
+/** An answer's JSON, or `undefined` when it has no body (a 202 or a 204). */
+async function answerOf(response) {
+    const text = await response.text();
+    if (text === '')
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        // The parser's message would quote the body.
+        throw new Error('GitHub answered a body that is not JSON');
+    }
+}
+/**
+ * One call to `url` (an address under the API's base), answering its JSON, or `undefined` for an answer without a
+ * body. Sends `Authorization: Bearer <token>`, `Accept: application/vnd.github+json` unless told otherwise,
+ * `X-GitHub-Api-Version` and `User-Agent`.
+ */
+export async function githubFetch(fetchImpl, url, request) {
+    return answerOf(await githubSend(fetchImpl, url, request));
+}
+/** The address a `Link` header names as `rel="next"`, or null. */
+export function nextPage(link) {
+    if (link === null)
+        return null;
+    const match = /<([^>]*)>\s*;\s*rel="next"/.exec(link);
+    return match === null ? null : match[1];
+}
+/**
+ * Each page of a listing as its JSON, following `Link: <...>; rel="next"`. A next page on another origin than the
+ * first is refused, so the bearer never leaves the API it was sent to.
+ */
+export async function* githubPages(fetchImpl, url, request) {
+    const origin = new URL(url).origin;
+    let next = url;
+    while (next !== null) {
+        const response = await githubSend(fetchImpl, next, request);
+        const link = response.headers.get('link');
+        yield await answerOf(response);
+        next = nextPage(link);
+        if (next !== null && new URL(next).origin !== origin)
+            throw new Error('GitHub named a next page on another origin');
+    }
+}
+/** Every item of a listing across its pages; `items` takes a page's JSON and answers its items. */
+export async function pages(fetchImpl, url, request, items) {
+    const all = [];
+    for await (const page of githubPages(fetchImpl, url, request))
+        all.push(...items(page));
+    return all;
+}
+/** An answer's object; `what` names it in the error when it is not one. */
+export function objectOf(value, what) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error(`GitHub answered ${what} that is not an object`);
+    return value;
+}
+/** An answer's array; `what` names it in the error when it is not one. */
+export function arrayOf(value, what) {
+    if (!Array.isArray(value))
+        throw new Error(`GitHub answered ${what} that is not a list`);
+    return value;
+}
+/** A number field of an answer's object. */
+export function numberIn(fields, key, what) {
+    const value = fields[key];
+    if (typeof value !== 'number')
+        throw new Error(`GitHub answered ${what} without a number ${key}`);
+    return value;
+}
+/** A string field of an answer's object. */
+export function stringIn(fields, key, what) {
+    const value = fields[key];
+    if (typeof value !== 'string')
+        throw new Error(`GitHub answered ${what} without a string ${key}`);
+    return value;
+}
+//# sourceMappingURL=http.js.map

package/dist/app/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/app/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE/C,yBAAyB;AACzB,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAmBxD,yGAAyG;AACzG,MAAM,OAAO,cAAe,SAAQ,KAAK;IAElB;IADrB,qDAAqD;IACrD,YAAqB,MAAc;QACjC,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;QADhB,WAAM,GAAN,MAAM,CAAQ;QAEjC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,MAAM,GAAG,6BAA6B;IACjF,OAAO;QACL,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,MAAM;QACN,sBAAsB,EAAE,kBAAkB;QAC1C,YAAY,EAAE,oBAAoB;KACnC,CAAC;AACJ,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAkB;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAuB,EAAE,GAAW,EAAE,OAAsB;IAC3F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;QAC7C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAuB,EAAE,GAAW,EAAE,OAAsB;IAC5F,OAAO,QAAQ,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CAAC,IAAmB;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,WAAW,CAAC,SAAuB,EAAE,GAAW,EAAE,OAAsB;IAC7F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,IAAI,GAAkB,GAAG,CAAC;IAC9B,OAAO,IAAI,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtH,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,KAAK,CAAI,SAAuB,EAAE,GAAW,EAAE,OAAsB,EAAE,KAAsC;IACjI,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,wBAAwB,CAAC,CAAC;IAC1I,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,QAAQ,CAAC,MAA+B,EAAE,GAAW,EAAE,IAAY;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,qBAAqB,GAAG,EAAE,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,QAAQ,CAAC,MAA+B,EAAE,GAAW,EAAE,IAAY;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,qBAAqB,GAAG,EAAE,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/app/installations.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @fileoverview What a user token reaches (the person, the app's installations they can access, and the repositories
+ * of an installation they can read) and the app's own installations, listed and removed with its JWT. Each function
+ * takes `{ fetchImpl, apiBase }` last: `fetch` and GitHub's API when absent.
+ * @module agentos-ext-github/app/installations
+ */
+import type { GitHubAppCredential } from './credential.js';
+import { type GitHubApiOptions } from './http.js';
+/** The person a user token belongs to. */
+export interface GitHubUser {
+    id: number;
+    login: string;
+}
+/** The account an installation is on: a user's or an organization's login, or an enterprise's slug. */
+export interface GitHubAccount {
+    login: string;
+    id: number;
+}
+/** One installation of the app; GitHub may answer it without an account. */
+export interface GitHubInstallation {
+    id: number;
+    account: GitHubAccount | null;
+}
+/** A repository a user token can read in an installation. */
+export interface UserRepository {
+    id: number;
+    fullName: string;
+    defaultBranch: string;
+}
+/** The person a user token belongs to (`GET /user`): the GitHub id and login a link is made by. */
+export declare function userOfToken(token: string, { fetchImpl, apiBase }?: GitHubApiOptions): Promise<GitHubUser>;
+/** The app's installations a user token can access (`GET /user/installations`), across every page. */
+export declare function installationsOfUser(token: string, { fetchImpl, apiBase }?: GitHubApiOptions): Promise<GitHubInstallation[]>;
+/**
+ * The repositories of an installation a user token can read (`GET /user/installations/{installation_id}/repositories`),
+ * across every page: those the person owns, collaborates on or reaches through an organization.
+ */
+export declare function repositoriesOfUser(token: string, installationId: number, { fetchImpl, apiBase }?: GitHubApiOptions): Promise<UserRepository[]>;
+/** Every installation of the app (`GET /app/installations`, with its JWT), across every page. */
+export declare function listInstallations(credential: GitHubAppCredential, { fetchImpl, apiBase }?: GitHubApiOptions): Promise<GitHubInstallation[]>;
+/**
+ * Uninstalls the app from an account (`DELETE /app/installations/{installation_id}`, with its JWT). Answers without an
+ * error on 202 (GitHub has taken the removal and does it in the background at the pinned API version), on 204 (the
+ * answer of earlier versions) and on 404 (the installation is already gone); the answer's body is never read. Any
+ * other status throws {@link GitHubApiError}.
+ */
+export declare function uninstallInstallation(credential: GitHubAppCredential, installationId: number, { fetchImpl, apiBase }?: GitHubApiOptions): Promise<void>;
+//# sourceMappingURL=installations.d.ts.map

package/dist/app/installations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/app/installations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAWL,KAAK,gBAAgB,EACtB,MAAM,WAAW,CAAC;AAEnB,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;CAC/B;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAcD,mGAAmG;AACnG,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAiB,EAAE,OAAyB,EAAE,GAAE,gBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAG7I;AAED,sGAAsG;AACtG,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAiB,EAAE,OAAyB,EAAE,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAI/J;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,EAAE,SAAiB,EAAE,OAAyB,EAAE,GAAE,gBAAqB,GACtE,OAAO,CAAC,cAAc,EAAE,CAAC,CAW3B;AAED,iGAAiG;AACjG,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,mBAAmB,EAAE,EAAE,SAAiB,EAAE,OAAyB,EAAE,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAE/K;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,mBAAmB,EAC/B,cAAc,EAAE,MAAM,EACtB,EAAE,SAAiB,EAAE,OAAyB,EAAE,GAAE,gBAAqB,GACtE,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/app/installations.js

@@ -0,0 +1,61 @@
+/**
+ * @fileoverview What a user token reaches (the person, the app's installations they can access, and the repositories
+ * of an installation they can read) and the app's own installations, listed and removed with its JWT. Each function
+ * takes `{ fetchImpl, apiBase }` last: `fetch` and GitHub's API when absent.
+ * @module agentos-ext-github/app/installations
+ */
+import { arrayOf, discardBody, GITHUB_API_BASE, GitHubApiError, githubFetch, githubSend, numberIn, objectOf, pages, stringIn, } from './http.js';
+function installationOf(value) {
+    const fields = objectOf(value, 'an installation');
+    const account = fields.account === null || fields.account === undefined ? null : objectOf(fields.account, "an installation's account");
+    return {
+        id: numberIn(fields, 'id', 'an installation'),
+        account: account === null
+            ? null
+            : { login: stringIn(account, typeof account.login === 'string' ? 'login' : 'slug', "an installation's account"), id: numberIn(account, 'id', "an installation's account") },
+    };
+}
+/** The person a user token belongs to (`GET /user`): the GitHub id and login a link is made by. */
+export async function userOfToken(token, { fetchImpl = fetch, apiBase = GITHUB_API_BASE } = {}) {
+    const user = objectOf(await githubFetch(fetchImpl, `${apiBase}/user`, { token }), 'a user');
+    return { id: numberIn(user, 'id', 'a user'), login: stringIn(user, 'login', 'a user') };
+}
+/** The app's installations a user token can access (`GET /user/installations`), across every page. */
+export async function installationsOfUser(token, { fetchImpl = fetch, apiBase = GITHUB_API_BASE } = {}) {
+    return pages(fetchImpl, `${apiBase}/user/installations?per_page=100`, { token }, (page) => arrayOf(objectOf(page, 'a page of installations').installations, 'a page of installations').map(installationOf));
+}
+/**
+ * The repositories of an installation a user token can read (`GET /user/installations/{installation_id}/repositories`),
+ * across every page: those the person owns, collaborates on or reaches through an organization.
+ */
+export async function repositoriesOfUser(token, installationId, { fetchImpl = fetch, apiBase = GITHUB_API_BASE } = {}) {
+    return pages(fetchImpl, `${apiBase}/user/installations/${installationId}/repositories?per_page=100`, { token }, (page) => arrayOf(objectOf(page, 'a page of repositories').repositories, 'a page of repositories').map((value) => {
+        const repository = objectOf(value, 'a repository');
+        return {
+            id: numberIn(repository, 'id', 'a repository'),
+            fullName: stringIn(repository, 'full_name', 'a repository'),
+            defaultBranch: stringIn(repository, 'default_branch', 'a repository'),
+        };
+    }));
+}
+/** Every installation of the app (`GET /app/installations`, with its JWT), across every page. */
+export async function listInstallations(credential, { fetchImpl = fetch, apiBase = GITHUB_API_BASE } = {}) {
+    return pages(fetchImpl, `${apiBase}/app/installations?per_page=100`, { token: credential.jwt() }, (page) => arrayOf(page, 'a page of installations').map(installationOf));
+}
+/**
+ * Uninstalls the app from an account (`DELETE /app/installations/{installation_id}`, with its JWT). Answers without an
+ * error on 202 (GitHub has taken the removal and does it in the background at the pinned API version), on 204 (the
+ * answer of earlier versions) and on 404 (the installation is already gone); the answer's body is never read. Any
+ * other status throws {@link GitHubApiError}.
+ */
+export async function uninstallInstallation(credential, installationId, { fetchImpl = fetch, apiBase = GITHUB_API_BASE } = {}) {
+    try {
+        await discardBody(await githubSend(fetchImpl, `${apiBase}/app/installations/${installationId}`, { token: credential.jwt(), method: 'DELETE' }));
+    }
+    catch (error) {
+        if (error instanceof GitHubApiError && error.status === 404)
+            return;
+        throw error;
+    }
+}
+//# sourceMappingURL=installations.js.map

package/dist/app/installations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.js","sourceRoot":"","sources":["../../src/app/installations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,OAAO,EACP,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,QAAQ,GAET,MAAM,WAAW,CAAC;AA2BnB,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACvI,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC;QAC7C,OAAO,EACL,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,2BAA2B,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,2BAA2B,CAAC,EAAE;KAChL,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,EAAE,SAAS,GAAG,KAAK,EAAE,OAAO,GAAG,eAAe,KAAuB,EAAE;IACtH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,OAAO,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5F,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,EAAE,SAAS,GAAG,KAAK,EAAE,OAAO,GAAG,eAAe,KAAuB,EAAE;IAC9H,OAAO,KAAK,CAAC,SAAS,EAAE,GAAG,OAAO,kCAAkC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CACxF,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAChH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,cAAsB,EACtB,EAAE,SAAS,GAAG,KAAK,EAAE,OAAO,GAAG,eAAe,KAAuB,EAAE;IAEvE,OAAO,KAAK,CAAC,SAAS,EAAE,GAAG,OAAO,uBAAuB,cAAc,4BAA4B,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CACvH,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACrG,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC;YAC9C,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC;YAC3D,aAAa,EAAE,QAAQ,CAAC,UAAU,EAAE,gBAAgB,EAAE,cAAc,CAAC;SACtE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAA+B,EAAE,EAAE,SAAS,GAAG,KAAK,EAAE,OAAO,GAAG,eAAe,KAAuB,EAAE;IAC9I,OAAO,KAAK,CAAC,SAAS,EAAE,GAAG,OAAO,iCAAiC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5K,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAA+B,EAC/B,cAAsB,EACtB,EAAE,SAAS,GAAG,KAAK,EAAE,OAAO,GAAG,eAAe,KAAuB,EAAE;IAEvE,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,OAAO,sBAAsB,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/app/reconcile.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @fileoverview The daily reconcile of a GitHub App's links, for what its webhook deliveries missed: deliveries are lost
+ * while a server is down, and GitHub does not deliver a failed one again by itself.
+ * @module agentos-ext-github/app/reconcile
+ */
+import type { GitHubAppCredential } from './credential.js';
+import { type GitHubApiOptions } from './http.js';
+/** A repository of a link, with the head of its default branch last read (null when none was read yet). */
+export interface ReconcileRepository {
+    id: number;
+    fullName: string;
+    defaultBranch: string;
+    headCommit: string | null;
+}
+/** A link: an installation and the repositories read through it. */
+export interface ReconcileLink {
+    installationId: number;
+    repositories: readonly ReconcileRepository[];
+}
+/** The window of deliveries to look at, and where calls go. */
+export interface ReconcileOptions extends GitHubApiOptions {
+    /** The start of the window: failed deliveries since then are asked for again. */
+    since: Date;
+}
+/** A repository whose default branch moved past the head last read. */
+export interface MovedRepository {
+    installationId: number;
+    repositoryId: number;
+    /** The head to read. */
+    head: string;
+}
+/** A repository whose head could not be read, with GitHub's status (for example 404 or 422 once it left the installation). */
+export interface UnreadableRepository {
+    installationId: number;
+    repositoryId: number;
+    status: number;
+}
+/** What the reconcile found and did. */
+export interface ReconcileOutcome {
+    /** Installations the app no longer has: their links and documents go. */
+    gone: number[];
+    /** Repositories to compare by tree, as a push to their default branch is. */
+    moved: MovedRepository[];
+    /** Deliveries asked for again. */
+    redelivered: number[];
+    /** Repositories whose head GitHub would not answer. */
+    unreadable: UnreadableRepository[];
+}
+/**
+ * Reconciles a GitHub App's links with GitHub: an installation that `GET /app/installations` no longer lists is
+ * answered gone; each repository of the other links has its default branch's head read with an installation token
+ * narrowed to it and is answered moved when the head differs from the one last read, or unreadable with GitHub's
+ * status; and the app's failed deliveries since `since` are asked for again
+ * (`GET /app/hook/deliveries`, `POST /app/hook/deliveries/{delivery_id}/attempts`).
+ *
+ * @param credential The app's credential.
+ * @param links The links to check.
+ * @param options The window's start, and where calls go.
+ */
+export declare function reconcileInstallations(credential: GitHubAppCredential, links: readonly ReconcileLink[], { since, fetchImpl, apiBase }: ReconcileOptions): Promise<ReconcileOutcome>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/app/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/app/reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAWL,KAAK,gBAAgB,EACtB,MAAM,WAAW,CAAC;AAGnB,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC9C;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC;CACb;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8HAA8H;AAC9H,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6EAA6E;IAC7E,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,uDAAuD;IACvD,UAAU,EAAE,oBAAoB,EAAE,CAAC;CACpC;AAgDD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,mBAAmB,EAC/B,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,EAAE,KAAK,EAAE,SAAiB,EAAE,OAAyB,EAAE,EAAE,gBAAgB,GACxE,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}

package/dist/app/reconcile.js

@@ -0,0 +1,89 @@
+/**
+ * @fileoverview The daily reconcile of a GitHub App's links, for what its webhook deliveries missed: deliveries are lost
+ * while a server is down, and GitHub does not deliver a failed one again by itself.
+ * @module agentos-ext-github/app/reconcile
+ */
+import { arrayOf, discardBody, GITHUB_API_BASE, GitHubApiError, githubFetch, githubPages, githubSend, numberIn, objectOf, stringIn, } from './http.js';
+import { listInstallations } from './installations.js';
+function deliveryOf(value) {
+    const fields = objectOf(value, 'a delivery');
+    const status = numberIn(fields, 'status_code', 'a delivery');
+    return {
+        id: numberIn(fields, 'id', 'a delivery'),
+        guid: stringIn(fields, 'guid', 'a delivery'),
+        deliveredAt: Date.parse(stringIn(fields, 'delivered_at', 'a delivery')),
+        succeeded: status >= 200 && status < 300,
+    };
+}
+/**
+ * Asks again for each event of the window that no attempt delivered: the newest failed attempt of each delivery guid
+ * with no successful attempt since `since`. GitHub lists deliveries newest first, so the pages stop at the first one
+ * that reaches past the window.
+ */
+async function redeliverFailures(credential, since, fetchImpl, apiBase) {
+    const attemptsByGuid = new Map();
+    for await (const page of githubPages(fetchImpl, `${apiBase}/app/hook/deliveries?per_page=100`, { token: credential.jwt() })) {
+        const deliveries = arrayOf(page, 'a page of deliveries').map(deliveryOf);
+        for (const delivery of deliveries) {
+            if (!(delivery.deliveredAt >= since))
+                continue;
+            const attempts = attemptsByGuid.get(delivery.guid);
+            if (attempts === undefined)
+                attemptsByGuid.set(delivery.guid, [delivery]);
+            else
+                attempts.push(delivery);
+        }
+        if (deliveries.length === 0 || deliveries.some((delivery) => !(delivery.deliveredAt >= since)))
+            break;
+    }
+    const redelivered = [];
+    for (const attempts of attemptsByGuid.values()) {
+        if (attempts.some((attempt) => attempt.succeeded))
+            continue;
+        const latest = attempts.reduce((newest, attempt) => (attempt.deliveredAt > newest.deliveredAt ? attempt : newest));
+        await discardBody(await githubSend(fetchImpl, `${apiBase}/app/hook/deliveries/${latest.id}/attempts`, { token: credential.jwt(), method: 'POST' }));
+        redelivered.push(latest.id);
+    }
+    return redelivered;
+}
+/**
+ * Reconciles a GitHub App's links with GitHub: an installation that `GET /app/installations` no longer lists is
+ * answered gone; each repository of the other links has its default branch's head read with an installation token
+ * narrowed to it and is answered moved when the head differs from the one last read, or unreadable with GitHub's
+ * status; and the app's failed deliveries since `since` are asked for again
+ * (`GET /app/hook/deliveries`, `POST /app/hook/deliveries/{delivery_id}/attempts`).
+ *
+ * @param credential The app's credential.
+ * @param links The links to check.
+ * @param options The window's start, and where calls go.
+ */
+export async function reconcileInstallations(credential, links, { since, fetchImpl = fetch, apiBase = GITHUB_API_BASE }) {
+    const listed = new Set((await listInstallations(credential, { fetchImpl, apiBase })).map((installation) => installation.id));
+    const gone = [];
+    const moved = [];
+    const unreadable = [];
+    for (const link of links) {
+        if (!listed.has(link.installationId)) {
+            if (!gone.includes(link.installationId))
+                gone.push(link.installationId);
+            continue;
+        }
+        for (const repository of link.repositories) {
+            try {
+                const token = await credential.installationToken(link.installationId, [repository.id]);
+                const branch = objectOf(await githubFetch(fetchImpl, `${apiBase}/repos/${repository.fullName}/branches/${encodeURIComponent(repository.defaultBranch)}`, { token }), 'a branch');
+                const head = stringIn(objectOf(branch.commit, "a branch's commit"), 'sha', "a branch's commit");
+                if (head !== repository.headCommit)
+                    moved.push({ installationId: link.installationId, repositoryId: repository.id, head });
+            }
+            catch (error) {
+                if (!(error instanceof GitHubApiError))
+                    throw error;
+                unreadable.push({ installationId: link.installationId, repositoryId: repository.id, status: error.status });
+            }
+        }
+    }
+    const redelivered = await redeliverFailures(credential, since.getTime(), fetchImpl, apiBase);
+    return { gone, moved, redelivered, unreadable };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/app/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../../src/app/reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,OAAO,EACP,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,QAAQ,GAET,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAyDvD,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QACvE,SAAS,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;KACzC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,UAA+B,EAAE,KAAa,EAAE,SAAuB,EAAE,OAAe;IACvH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;IACrD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,EAAE,GAAG,OAAO,mCAAmC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5H,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC;gBAAE,SAAS;YAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,KAAK,SAAS;gBAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;;gBACrE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;IACxG,CAAC;IACD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,SAAS;QAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnH,MAAM,WAAW,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,OAAO,wBAAwB,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACpJ,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+B,EAC/B,KAA+B,EAC/B,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,OAAO,GAAG,eAAe,EAAoB;IAEzE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvF,MAAM,MAAM,GAAG,QAAQ,CACrB,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,OAAO,UAAU,UAAU,CAAC,QAAQ,aAAa,kBAAkB,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAC3I,UAAU,CACX,CAAC;gBACF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;gBAChG,IAAI,IAAI,KAAK,UAAU,CAAC,UAAU;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACpD,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC"}

package/dist/app/userFlow.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @fileoverview A GitHub App's user authorization on a web server: GitHub's authorize address with `state` and PKCE,
+ * and the code exchanged for a user access token, on the auth module's `RedirectOAuthFlow`. The token proves who the
+ * person is and which installations and repositories they can reach; it is used once and dropped, so the flow has no
+ * store.
+ * @module agentos-ext-github/app/userFlow
+ */
+import { RedirectOAuthFlow, type RedirectBegin, type RedirectOAuthConfig } from '@framers/agentos/auth';
+/** The app's OAuth client: its client id and client secret. */
+export interface GitHubAppClient {
+    clientId: string;
+    clientSecret: string;
+}
+/** GitHub's authorize and token addresses; a stand-in's in tests. */
+export interface GitHubOAuthEndpoints {
+    authorize: string;
+    token: string;
+}
+/** github.com's own authorize and token addresses. */
+export declare const GITHUB_OAUTH_ENDPOINTS: GitHubOAuthEndpoints;
+/**
+ * The user's web flow for a GitHub App: `begin` answers the authorize address with the state and the PKCE verifier
+ * for the caller to keep, and `complete` checks the state and exchanges the code (with `code_verifier`, asking for a
+ * JSON answer) for the user's token. A GitHub App's permissions are the app's, not the token's, so the address carries
+ * no `scope`.
+ */
+export declare class GitHubAppUserFlow extends RedirectOAuthFlow {
+    private readonly client;
+    private readonly endpoints;
+    /** The provider's id. */
+    readonly providerId = "github";
+    /**
+     * @param client The app's client id and client secret.
+     * @param fetchImpl The fetch the code is exchanged with.
+     * @param endpoints GitHub's authorize and token addresses.
+     */
+    constructor(client: GitHubAppClient, fetchImpl?: typeof fetch, endpoints?: GitHubOAuthEndpoints);
+    /** GitHub's addresses and the app's client, with no scopes. */
+    protected getConfig(): RedirectOAuthConfig;
+    /** The authorize address with the state and the PKCE challenge, leaving out the empty `scope` the base would send. */
+    begin(input: Parameters<RedirectOAuthFlow['begin']>[0]): RedirectBegin;
+}
+//# sourceMappingURL=userFlow.d.ts.map

package/dist/app/userFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userFlow.d.ts","sourceRoot":"","sources":["../../src/app/userFlow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAExG,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,EAAE,oBAGpC,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,iBAAiB;IAS1C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAoD,OAAO,CAAC,QAAQ,CAAC,SAAS;IARjH,yBAAyB;IACzB,QAAQ,CAAC,UAAU,YAAY;IAE/B;;;;OAIG;gBAC0B,MAAM,EAAE,eAAe,EAAE,SAAS,GAAE,OAAO,KAAa,EAAmB,SAAS,GAAE,oBAA6C;IAIhK,+DAA+D;IAC/D,SAAS,CAAC,SAAS,IAAI,mBAAmB;IAU1C,sHAAsH;IAC7G,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa;CAMhF"}

package/dist/app/userFlow.js

@@ -0,0 +1,54 @@
+/**
+ * @fileoverview A GitHub App's user authorization on a web server: GitHub's authorize address with `state` and PKCE,
+ * and the code exchanged for a user access token, on the auth module's `RedirectOAuthFlow`. The token proves who the
+ * person is and which installations and repositories they can reach; it is used once and dropped, so the flow has no
+ * store.
+ * @module agentos-ext-github/app/userFlow
+ */
+import { RedirectOAuthFlow } from '@framers/agentos/auth';
+/** github.com's own authorize and token addresses. */
+export const GITHUB_OAUTH_ENDPOINTS = {
+    authorize: 'https://github.com/login/oauth/authorize',
+    token: 'https://github.com/login/oauth/access_token',
+};
+/**
+ * The user's web flow for a GitHub App: `begin` answers the authorize address with the state and the PKCE verifier
+ * for the caller to keep, and `complete` checks the state and exchanges the code (with `code_verifier`, asking for a
+ * JSON answer) for the user's token. A GitHub App's permissions are the app's, not the token's, so the address carries
+ * no `scope`.
+ */
+export class GitHubAppUserFlow extends RedirectOAuthFlow {
+    client;
+    endpoints;
+    /** The provider's id. */
+    providerId = 'github';
+    /**
+     * @param client The app's client id and client secret.
+     * @param fetchImpl The fetch the code is exchanged with.
+     * @param endpoints GitHub's authorize and token addresses.
+     */
+    constructor(client, fetchImpl = fetch, endpoints = GITHUB_OAUTH_ENDPOINTS) {
+        super(null, fetchImpl);
+        this.client = client;
+        this.endpoints = endpoints;
+    }
+    /** GitHub's addresses and the app's client, with no scopes. */
+    getConfig() {
+        return {
+            authorizationEndpoint: this.endpoints.authorize,
+            tokenEndpoint: this.endpoints.token,
+            scopes: [],
+            clientId: this.client.clientId,
+            clientSecret: this.client.clientSecret,
+        };
+    }
+    /** The authorize address with the state and the PKCE challenge, leaving out the empty `scope` the base would send. */
+    begin(input) {
+        const begun = super.begin(input);
+        const address = new URL(begun.url);
+        if (address.searchParams.get('scope') === '')
+            address.searchParams.delete('scope');
+        return { ...begun, url: address.toString() };
+    }
+}
+//# sourceMappingURL=userFlow.js.map

package/dist/app/userFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userFlow.js","sourceRoot":"","sources":["../../src/app/userFlow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAgD,MAAM,uBAAuB,CAAC;AAcxG,sDAAsD;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,SAAS,EAAE,0CAA0C;IACrD,KAAK,EAAE,6CAA6C;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,iBAAiB;IASzB;IAA2E;IARxG,yBAAyB;IAChB,UAAU,GAAG,QAAQ,CAAC;IAE/B;;;;OAIG;IACH,YAA6B,MAAuB,EAAE,YAA0B,KAAK,EAAmB,YAAkC,sBAAsB;QAC9J,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QADI,WAAM,GAAN,MAAM,CAAiB;QAAoD,cAAS,GAAT,SAAS,CAA+C;IAEhK,CAAC;IAED,+DAA+D;IACrD,SAAS;QACjB,OAAO;YACL,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;YAC/C,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;YACnC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;SACvC,CAAC;IACJ,CAAC;IAED,sHAAsH;IAC7G,KAAK,CAAC,KAAgD;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnF,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/app/webhook.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @fileoverview A webhook delivery's signature: `X-Hub-Signature-256` is `sha256=` and the hex HMAC SHA-256 of the raw
+ * body under the webhook's secret.
+ * @module agentos-ext-github/app/webhook
+ */
+/**
+ * True when `header` is `sha256=` and 64 hex digits that equal the HMAC SHA-256 of the raw body under the secret,
+ * compared in constant time. A missing header, another algorithm or another length is false.
+ *
+ * @param body The delivery's body exactly as received, before any parsing.
+ * @param header The `X-Hub-Signature-256` header, or null when the delivery had none.
+ * @param secret The webhook's secret.
+ */
+export declare function verifyWebhookSignature(body: Uint8Array, header: string | null, secret: string): boolean;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/app/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/app/webhook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAMvG"}

package/dist/app/webhook.js

@@ -0,0 +1,23 @@
+/**
+ * @fileoverview A webhook delivery's signature: `X-Hub-Signature-256` is `sha256=` and the hex HMAC SHA-256 of the raw
+ * body under the webhook's secret.
+ * @module agentos-ext-github/app/webhook
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/**
+ * True when `header` is `sha256=` and 64 hex digits that equal the HMAC SHA-256 of the raw body under the secret,
+ * compared in constant time. A missing header, another algorithm or another length is false.
+ *
+ * @param body The delivery's body exactly as received, before any parsing.
+ * @param header The `X-Hub-Signature-256` header, or null when the delivery had none.
+ * @param secret The webhook's secret.
+ */
+export function verifyWebhookSignature(body, header, secret) {
+    const match = header === null ? null : /^sha256=([0-9a-f]{64})$/i.exec(header);
+    if (match === null)
+        return false;
+    const given = Buffer.from(match[1], 'hex');
+    const expected = createHmac('sha256', secret).update(body).digest();
+    return given.length === expected.length && timingSafeEqual(given, expected);
+}
+//# sourceMappingURL=webhook.js.map

package/dist/app/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/app/webhook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAgB,EAAE,MAAqB,EAAE,MAAc;IAC5F,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC"}