@goodfellow-cms/github 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,18 +1,20 @@
-import { ConflictError, GitApiError, SignInError, credentialStorage, encodeBase64, encodeBase64Bytes } from "@goodfellow-cms/core";
+import { ConflictError, DomainError, DraftError, EditorsError, GitApiError, SetupError, SignInError, UpdatesError, branchDrafts, buildStepFor, compareReleases, credentialStorage, encodeBase64, encodeBase64Bytes, siteVersion } from "@goodfellow-cms/core";
 //#region src/api.ts
 /** Calls the GitHub REST or GraphQL API. Treats 401 as an expired sign-in; other errors become `GitApiError`. */
 async function githubRequest({ apiUrl, token, fetch }, path, init = {}) {
-	const response = await fetch(`${apiUrl}${path}`, {
+	const send = async (refresh) => fetch(`${apiUrl}${path}`, {
 		method: init.method ?? "GET",
 		headers: {
 			accept: init.accept ?? "application/vnd.github+json",
-			authorization: `Bearer ${token}`,
+			authorization: `Bearer ${typeof token === "string" ? token : await token({ refresh })}`,
 			"x-github-api-version": "2022-11-28",
 			...init.body !== void 0 && { "content-type": "application/json" }
 		},
 		body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
 		cache: "no-store"
 	});
+	let response = await send(false);
+	if (response.status === 401 && typeof token !== "string") response = await send(true);
 	if (response.status === 401) throw new SignInError("invalid", "GitHub didn't accept the sign-in. It may have expired.");
 	if (!response.ok && !init.allow?.includes(response.status)) {
 		const body = await response.json().catch(() => ({}));
@@ -28,7 +30,370 @@ function repoPath(repo) {
 	return repo.split("/").map((part) => encodeURIComponent(part)).join("/");
 }
 //#endregion
+//#region src/editors.ts
+/** GitHub account names: letters, digits and single hyphens, up to 39 characters. */
+const USERNAME = /^[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}$/i;
+const INVITATION = "invitation:";
+function roleOf(permissions) {
+	if (permissions?.admin) return "owner";
+	return permissions?.maintain || permissions?.push ? "editor" : "viewer";
+}
+function invitationRole(permission) {
+	if (permission === "admin") return "owner";
+	return permission === "write" || permission === "maintain" ? "editor" : "viewer";
+}
+function isNotAllowed(error) {
+	return error instanceof GitApiError && (error.status === 403 || error.status === 404);
+}
+/**
+* The repository's collaborators. Anyone who can publish can list them, but
+* inviting and removing people needs a token with GitHub's Administration
+* permission, which signing in doesn't ask for: `manage()` gives the owner
+* token when one is in use.
+*/
+function githubEditors(read, manage, repo, login) {
+	const path = `/repos/${repo}`;
+	function managing() {
+		const api = manage();
+		if (!api) throw new EditorsError("not-allowed", "Changing editors on GitHub needs an owner token.");
+		return api;
+	}
+	async function change(run) {
+		try {
+			await run(managing());
+		} catch (error) {
+			if (isNotAllowed(error)) throw new EditorsError("not-allowed", "This token can't change the site's editors.");
+			throw error;
+		}
+	}
+	async function collaborators(api) {
+		const all = [];
+		for (let page = 1; page <= 10; page++) {
+			const found = await githubJson(api, `${path}/collaborators?per_page=100&page=${page}`);
+			all.push(...found);
+			if (found.length < 100) break;
+		}
+		return all;
+	}
+	return {
+		invitesByEmail: false,
+		async list() {
+			const api = manage() ?? read;
+			const people = await collaborators(api);
+			let invitations;
+			try {
+				invitations = await githubJson(api, `${path}/invitations?per_page=100`);
+			} catch (error) {
+				if (!isNotAllowed(error)) throw error;
+			}
+			const editors = [...people.map((person) => ({
+				id: person.login,
+				login: person.login,
+				avatarUrl: person.avatar_url,
+				role: roleOf(person.permissions),
+				...person.login.toLowerCase() === login.toLowerCase() && { self: true }
+			})), ...(invitations ?? []).flatMap((invitation) => invitation.invitee ? [{
+				id: `${INVITATION}${invitation.id}`,
+				login: invitation.invitee.login,
+				avatarUrl: invitation.invitee.avatar_url,
+				role: invitationRole(invitation.permissions),
+				invited: true
+			}] : [])];
+			const owner = editors.some((editor) => editor.self && editor.role === "owner");
+			return {
+				editors,
+				manage: invitations ? "yes" : owner ? "token" : "no",
+				editorsCanPublish: true
+			};
+		},
+		async invite(who, role) {
+			const name = who.trim().replace(/^@/, "");
+			if (!USERNAME.test(name)) throw new EditorsError("invalid", "That isn't a GitHub username.");
+			const api = managing();
+			try {
+				await githubRequest(api, `${path}/collaborators/${encodeURIComponent(name)}`, {
+					method: "PUT",
+					body: { permission: role === "owner" ? "admin" : "push" }
+				});
+			} catch (error) {
+				if (error instanceof GitApiError && error.status === 404) {
+					if ((await githubRequest(api, `/users/${encodeURIComponent(name)}`, { allow: [404] })).status === 404) throw new EditorsError("not-found", `There's no GitHub account named ${name}.`);
+				}
+				if (isNotAllowed(error)) throw new EditorsError("not-allowed", "This token can't change the site's editors.");
+				if (error instanceof GitApiError && error.status === 422) throw new EditorsError("invalid", `GitHub didn't accept the invitation: ${error.message}`);
+				throw error;
+			}
+		},
+		async setRole(editor, role) {
+			await change(async (api) => {
+				if (editor.id.startsWith(INVITATION)) await githubRequest(api, `${path}/invitations/${editor.id.slice(11)}`, {
+					method: "PATCH",
+					body: { permissions: role === "owner" ? "admin" : "write" }
+				});
+				else await githubRequest(api, `${path}/collaborators/${encodeURIComponent(editor.id)}`, {
+					method: "PUT",
+					body: { permission: role === "owner" ? "admin" : "push" }
+				});
+			});
+		},
+		async remove(editor) {
+			await change((api) => githubRequest(api, editor.id.startsWith(INVITATION) ? `${path}/invitations/${editor.id.slice(11)}` : `${path}/collaborators/${encodeURIComponent(editor.id)}`, { method: "DELETE" }));
+		}
+	};
+}
+/**
+* The owner token: GitHub's Administration and Pages permissions, for this tab
+* only. With the sign-in worker, owners can sign in with its owners' app
+* instead (`redirect`), and `useSignIn()` gives the token that comes back.
+*/
+function githubOwnerAccess(base, repo, tokenLink, redirect) {
+	let owner;
+	let endSignIn;
+	let problem;
+	return {
+		access: {
+			tokenLink,
+			get active() {
+				return owner !== void 0;
+			},
+			get problem() {
+				return problem;
+			},
+			...redirect && { async startRedirect(options) {
+				problem = void 0;
+				await redirect(options);
+			} },
+			async applyToken(token) {
+				const api = {
+					...base,
+					token: token.trim()
+				};
+				try {
+					if (!(await githubJson(api, `/repos/${repo}`)).permissions?.admin) throw new EditorsError("not-allowed", "This token's account isn't an owner of the site.");
+					await githubJson(api, `/repos/${repo}/invitations?per_page=1`);
+				} catch (error) {
+					if (error instanceof EditorsError) throw error;
+					if (error instanceof SignInError || isNotAllowed(error)) throw new EditorsError("not-allowed", "This token can't change the site's editors.");
+					throw error;
+				}
+				owner = api;
+				problem = void 0;
+			},
+			forget() {
+				owner = void 0;
+				endSignIn?.();
+				endSignIn = void 0;
+			}
+		},
+		api: () => owner,
+		/** Uses an owner's sign-in through the worker. `end` runs when it's forgotten. */
+		useSignIn(token, end) {
+			owner = {
+				...base,
+				token
+			};
+			endSignIn = end;
+			problem = void 0;
+		},
+		/** Remembers why an owner's sign-in didn't work, for the screen that started it to show. */
+		failed(error) {
+			problem = error;
+		}
+	};
+}
+//#endregion
+//#region src/pages.ts
+/** GitHub Pages' addresses for an apex domain, from GitHub's documentation. */
+const PAGES_IPV4 = [
+	"185.199.108.153",
+	"185.199.109.153",
+	"185.199.110.153",
+	"185.199.111.153"
+];
+const PAGES_IPV6 = [
+	"2606:50c0:8000::153",
+	"2606:50c0:8001::153",
+	"2606:50c0:8002::153",
+	"2606:50c0:8003::153"
+];
+/** Certificate states in which GitHub serves the domain over HTTPS. */
+const READY = /* @__PURE__ */ new Set([
+	"approved",
+	"issued",
+	"uploaded"
+]);
+const FAILED = /* @__PURE__ */ new Set([
+	"errored",
+	"bad_authz",
+	"authorization_revoked"
+]);
+/** The records GitHub Pages needs: its addresses for an apex domain, or an alias of the owner's github.io. */
+function githubPagesRecords(repo, domain, { apex, www }) {
+	const target = `${(repo.split("/")[0] ?? "").toLowerCase()}.github.io`;
+	if (!apex) return [{
+		type: "CNAME",
+		name: domain,
+		value: target,
+		purpose: "site"
+	}];
+	return [
+		...PAGES_IPV4.map((value) => ({
+			type: "A",
+			name: domain,
+			value,
+			purpose: "site"
+		})),
+		...PAGES_IPV6.map((value) => ({
+			type: "AAAA",
+			name: domain,
+			value,
+			purpose: "site",
+			optional: true
+		})),
+		...www ? [{
+			type: "CNAME",
+			name: `www.${domain}`,
+			value: target,
+			purpose: "www",
+			optional: true
+		}] : []
+	];
+}
+/**
+* GitHub Pages, for a site's repository: where it's published, and its custom
+* domain. `api` gives the owner token when one is in use (see `ownerAccess`).
+*/
+function githubPages(api, repo) {
+	const path = `/repos/${repo}/pages`;
+	async function pages() {
+		const response = await githubRequest(api(), path, { allow: [404] });
+		return response.status === 404 ? void 0 : await response.json();
+	}
+	async function update(body) {
+		try {
+			await githubRequest(api(), path, {
+				method: "PUT",
+				body
+			});
+		} catch (error) {
+			if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new DomainError("not-allowed", "This sign-in can't change the site's GitHub Pages settings.");
+			if (error instanceof GitApiError && (error.status === 400 || error.status === 422)) {
+				if (/taken|already/i.test(error.message)) throw new DomainError("taken", "Another GitHub Pages site already uses this domain.");
+				if ("https_enforced" in body) throw new DomainError("not-ready", "The domain's certificate isn't ready yet.");
+				throw new DomainError("invalid", "GitHub Pages doesn't accept this domain.");
+			}
+			throw error;
+		}
+	}
+	return {
+		async site() {
+			const found = await pages();
+			return found && {
+				url: found.html_url,
+				domain: found.cname ?? void 0
+			};
+		},
+		async connect(domain, options) {
+			await update({ cname: domain });
+			return githubPagesRecords(repo, domain, options);
+		},
+		async records(domain, options) {
+			return githubPagesRecords(repo, domain, options);
+		},
+		async status(domain) {
+			const found = await githubJson(api(), path);
+			const state = found.https_certificate?.state ?? "";
+			return {
+				verified: true,
+				certificate: READY.has(state) ? "ready" : FAILED.has(state) ? "failed" : "pending",
+				httpsOnly: found.https_enforced === true,
+				primary: found.cname === domain
+			};
+		},
+		async secure() {
+			await update({ https_enforced: true });
+		},
+		async disconnect() {
+			await update({ cname: null });
+		}
+	};
+}
+//#endregion
+//#region src/updates.ts
+/** The starters' GitHub Pages workflow, which runs `goodfellow update` each night and when it's dispatched. */
+const WORKFLOW = "deploy.yml";
+const WORKFLOW_FILE = `.github/workflows/${WORKFLOW}`;
+/**
+* The site's nightly update, which runs in its GitHub Pages workflow. Running
+* it now dispatches the workflow, which needs GitHub's Actions permission
+* with write access: `manage()` gives the owner token when one is in use.
+*/
+function githubUpdates(read, manage, repo, branch, files) {
+	const path = `/repos/${repo}/actions/workflows/${WORKFLOW}`;
+	return {
+		async setup() {
+			return (await files.read(WORKFLOW_FILE))?.includes("update --publish") ? "ready" : "missing";
+		},
+		async lastRun() {
+			const response = await githubRequest(read, `${path}/runs?branch=${encodeURIComponent(branch)}&per_page=20`, { allow: [403, 404] });
+			if (!response.ok) return void 0;
+			const { workflow_runs: runs = [] } = await response.json();
+			for (const run of runs.filter((candidate) => ["schedule", "workflow_dispatch"].includes(candidate.event))) {
+				const base = {
+					date: run.created_at,
+					detailsUrl: run.html_url
+				};
+				if (run.status !== "completed") return {
+					state: "running",
+					...base
+				};
+				const { jobs = [] } = await githubJson(read, `/repos/${repo}/actions/runs/${run.id}/jobs`);
+				const job = jobs.find((candidate) => candidate.name === "update");
+				if (!job || job.conclusion === "skipped") continue;
+				if (job.conclusion !== "success") return {
+					state: "failed",
+					...base
+				};
+				const before = siteVersion(await files.readAt("package.json", run.head_sha) ?? "");
+				const now = siteVersion(await files.read("package.json") ?? "");
+				if (!before || !now || before === now) return {
+					state: "up-to-date",
+					...base
+				};
+				const rollback = compareReleases(now, before) < 0;
+				return {
+					state: "updated",
+					...base,
+					result: {
+						state: "updated",
+						from: before,
+						to: now,
+						...rollback && { rollback }
+					}
+				};
+			}
+		},
+		async start(target) {
+			try {
+				await githubRequest(manage() ?? read, `${path}/dispatches`, {
+					method: "POST",
+					body: {
+						ref: branch,
+						inputs: { update: target }
+					}
+				});
+			} catch (error) {
+				if (error instanceof GitApiError && (error.status === 403 || error.status === 401)) throw new UpdatesError("not-allowed", "Running the update needs a token that can run the site's workflows.");
+				if (error instanceof GitApiError && (error.status === 404 || error.status === 422)) throw new UpdatesError("missing", "The site's GitHub Pages workflow doesn't update Goodfellow.");
+				throw error;
+			}
+		}
+	};
+}
+//#endregion
 //#region src/backend.ts
+/** How many files one GraphQL request reads. */
+const GRAPHQL_BATCH = 100;
 const COMMIT_MUTATION = `mutation ($input: CreateCommitOnBranchInput!) {
   createCommitOnBranch(input: $input) { commit { oid } }
 }`;
@@ -37,21 +402,99 @@ const COMMIT_MUTATION = `mutation ($input: CreateCommitOnBranchInput!) {
 * returned; saves are single commits made with GraphQL's `createCommitOnBranch`,
 * which fails if the branch has moved, so nothing is ever overwritten.
 */
-var GitHubBackend = class {
+var GitHubBackend = class GitHubBackend {
 	user;
+	pages;
+	editors;
+	ownerAccess;
+	updates;
+	drafts;
+	options;
 	api;
 	repo;
 	branch;
 	onSignOut;
+	author;
+	owner;
 	pinned;
 	trees = /* @__PURE__ */ new Map();
+	/** Each file's size in bytes at a commit, which GitHub lists with its tree. */
+	treeSizes = /* @__PURE__ */ new Map();
 	blobs = /* @__PURE__ */ new Map();
 	constructor(options) {
+		this.options = options;
 		this.api = options.api;
 		this.repo = repoPath(options.repo);
 		this.branch = options.branch;
 		this.user = options.user;
 		this.onSignOut = options.onSignOut;
+		this.author = options.author;
+		const owner = githubOwnerAccess(this.api, this.repo, options.ownerTokenLink, options.ownerRedirect);
+		this.owner = owner;
+		this.ownerAccess = owner.access;
+		this.pages = githubPages(() => owner.api() ?? this.api, this.repo);
+		this.editors = githubEditors(this.api, owner.api, this.repo, this.user.login);
+		this.updates = githubUpdates(this.api, owner.api, this.repo, this.branch, this);
+		this.drafts = branchDrafts(this, this.draftHost());
+	}
+	/** Drafts on branches of the repository, with pull requests for review. */
+	draftHost() {
+		const base = `/repos/${this.repo}`;
+		const ref = (branch) => `${base}/git/refs/heads/${encodeURIComponent(branch)}`;
+		return {
+			liveBranch: this.branch,
+			branchStore: (branch) => new GitHubBackend({
+				...this.options,
+				branch
+			}),
+			createBranch: async (branch, revision) => {
+				if ((await githubRequest(this.api, `${base}/git/refs`, {
+					method: "POST",
+					body: {
+						ref: `refs/heads/${branch}`,
+						sha: revision
+					},
+					allow: [422]
+				})).status === 422) throw new DraftError("exists", `There's already a draft called ${branch}.`);
+			},
+			deleteBranch: async (branch) => {
+				await githubRequest(this.api, ref(branch), {
+					method: "DELETE",
+					allow: [404, 422]
+				});
+			},
+			mergeBase: async (branch) => {
+				const response = await githubRequest(this.api, `${base}/compare/${encodeURIComponent(this.branch)}...${encodeURIComponent(branch)}`, { allow: [404] });
+				if (response.status === 404) throw new DraftError("not-found", `There's no draft ${branch}.`);
+				return (await response.json()).merge_base_commit.sha;
+			},
+			openReview: async ({ branch, title, description }) => {
+				const response = await githubRequest(this.api, `${base}/pulls`, {
+					method: "POST",
+					body: {
+						title,
+						head: branch,
+						base: this.branch,
+						body: description
+					},
+					allow: [
+						403,
+						404,
+						422
+					]
+				});
+				if (response.ok) return { url: (await response.json()).html_url };
+				if (response.status !== 422) throw new DraftError("no-reviews", "This sign-in can't open pull requests on the site's repository.");
+				const owner = decodeURIComponent(this.repo).split("/")[0];
+				const query = new URLSearchParams({
+					head: `${owner}:${branch}`,
+					state: "open"
+				});
+				const [open] = await githubJson(this.api, `${base}/pulls?${query}`);
+				if (!open) throw new GitApiError(422, "GitHub couldn't open the pull request.");
+				return { url: open.html_url };
+			}
+		};
 	}
 	async revision() {
 		const ref = await githubJson(this.api, `/repos/${this.repo}/git/ref/heads/${encodeURIComponent(this.branch)}`);
@@ -64,7 +507,9 @@ var GitHubBackend = class {
 		if (!tree) {
 			tree = githubJson(this.api, `/repos/${this.repo}/git/trees/${sha}?recursive=1`).then((response) => {
 				if (response.truncated) throw new GitApiError(413, "The repository has too many files for GitHub to list at once.");
-				return new Map(response.tree.filter((entry) => entry.type === "blob").map((entry) => [entry.path, entry.sha]));
+				const blobs = response.tree.filter((entry) => entry.type === "blob");
+				this.treeSizes.set(sha, new Map(blobs.flatMap((entry) => entry.size === void 0 ? [] : [[entry.path, entry.size]])));
+				return new Map(blobs.map((entry) => [entry.path, entry.sha]));
 			});
 			tree.catch(() => this.trees.delete(sha));
 			this.trees.set(sha, tree);
@@ -75,8 +520,11 @@ var GitHubBackend = class {
 		return this.tree(this.pinned ?? await this.revision());
 	}
 	async read(path) {
-		const sha = (await this.currentTree()).get(path);
-		if (!sha) return void 0;
+		return this.readFrom(await this.currentTree(), path);
+	}
+	readFrom(tree, path) {
+		const sha = tree.get(path);
+		if (!sha) return Promise.resolve(void 0);
 		let blob = this.blobs.get(sha);
 		if (!blob) {
 			blob = githubRequest(this.api, `/repos/${this.repo}/git/blobs/${sha}`, { accept: "application/vnd.github.raw+json" }).then((response) => response.text());
@@ -85,6 +533,40 @@ var GitHubBackend = class {
 		}
 		return blob;
 	}
+	/** Reads many text files in a few GraphQL requests rather than one request each. */
+	async readFiles(paths) {
+		const tree = await this.currentTree();
+		const wanted = paths.flatMap((path) => {
+			const sha = tree.get(path);
+			return sha ? [[path, sha]] : [];
+		});
+		const fetch = [...new Set(wanted.map(([, sha]) => sha).filter((sha) => !this.blobs.has(sha)))];
+		const [owner, name] = decodeURIComponent(this.repo).split("/");
+		for (let start = 0; start < fetch.length; start += GRAPHQL_BATCH) {
+			const batch = fetch.slice(start, start + GRAPHQL_BATCH);
+			const fields = batch.map((sha, index) => `f${index}: object(oid: "${sha}") { ... on Blob { text isBinary } }`);
+			const response = await githubJson(this.api, "/graphql", {
+				method: "POST",
+				body: {
+					query: `query ($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { ${fields.join(" ")} } }`,
+					variables: {
+						owner,
+						name
+					}
+				}
+			});
+			batch.forEach((sha, index) => {
+				const blob = response.data?.repository?.[`f${index}`];
+				if (blob && !blob.isBinary && typeof blob.text === "string") this.blobs.set(sha, Promise.resolve(blob.text));
+			});
+		}
+		const result = /* @__PURE__ */ new Map();
+		for (const [path] of wanted) {
+			const text = await this.readFrom(tree, path);
+			if (text !== void 0) result.set(path, text);
+		}
+		return result;
+	}
 	async readBytes(path) {
 		const sha = (await this.currentTree()).get(path);
 		if (!sha) return void 0;
@@ -95,7 +577,100 @@ var GitHubBackend = class {
 		const prefix = `${dir}/`;
 		return [...(await this.currentTree()).keys()].filter((path) => path.startsWith(prefix)).sort();
 	}
-	async write(changes, { message, expectedRevision }) {
+	async fileSizes(dir) {
+		const prefix = `${dir}/`;
+		await this.currentTree();
+		const sizes = this.treeSizes.get(this.pinned ?? "") ?? /* @__PURE__ */ new Map();
+		return new Map([...sizes].filter(([path]) => path.startsWith(prefix)));
+	}
+	/** Uses an owner's sign-in through the worker for editors and GitHub Pages settings, until it's forgotten. */
+	useOwnerSignIn(token, end) {
+		this.owner.useSignIn(token, end);
+	}
+	/** Remembers why an owner's sign-in through the worker didn't work, which the Editors and Domain screens show. */
+	ownerSignInFailed(error) {
+		this.owner.failed(error);
+	}
+	async write(changes, options) {
+		return this.author ? this.writeCommit(changes, options, this.author) : this.writeGraphQL(changes, options);
+	}
+	/**
+	* Saves with Git's data API, naming the editor as the commit's author:
+	* GitHub refuses to move the branch unless the commit follows on from it, so
+	* nothing is overwritten.
+	*/
+	async writeCommit(changes, { message, expectedRevision }, author) {
+		const existing = await this.tree(expectedRevision);
+		const base = `/repos/${this.repo}`;
+		const entries = [];
+		try {
+			for (const change of changes) if ("delete" in change) {
+				if (existing.has(change.path)) entries.push({
+					path: change.path,
+					mode: "100644",
+					type: "blob",
+					sha: null
+				});
+			} else if ("bytes" in change) {
+				const blob = await githubJson(this.api, `${base}/git/blobs`, {
+					method: "POST",
+					body: {
+						content: encodeBase64Bytes(change.bytes),
+						encoding: "base64"
+					}
+				});
+				entries.push({
+					path: change.path,
+					mode: "100644",
+					type: "blob",
+					sha: blob.sha
+				});
+			} else entries.push({
+				path: change.path,
+				mode: "100644",
+				type: "blob",
+				content: change.content
+			});
+			if (entries.length === 0) return { revision: expectedRevision };
+			const parent = await githubJson(this.api, `${base}/git/commits/${expectedRevision}`);
+			const tree = await githubJson(this.api, `${base}/git/trees`, {
+				method: "POST",
+				body: {
+					base_tree: parent.tree.sha,
+					tree: entries
+				}
+			});
+			const commit = await githubJson(this.api, `${base}/git/commits`, {
+				method: "POST",
+				body: {
+					message,
+					tree: tree.sha,
+					parents: [expectedRevision],
+					author: {
+						...author,
+						date: (/* @__PURE__ */ new Date()).toISOString()
+					}
+				}
+			});
+			if ((await githubRequest(this.api, `${base}/git/refs/heads/${encodeURIComponent(this.branch)}`, {
+				method: "PATCH",
+				body: {
+					sha: commit.sha,
+					force: false
+				},
+				allow: [422]
+			})).status === 422) {
+				if (await this.revision() !== expectedRevision) throw new ConflictError();
+				throw new GitApiError(422, "GitHub couldn't save the changes.");
+			}
+			this.pinned = commit.sha;
+			return { revision: commit.sha };
+		} catch (error) {
+			if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SignInError("cant-publish", "This sign-in can't publish to the site.");
+			throw error;
+		}
+	}
+	async writeGraphQL(changes, { message, expectedRevision }) {
 		const existing = await this.tree(expectedRevision);
 		const additions = changes.flatMap((change) => "delete" in change ? [] : [{
 			path: change.path,
@@ -131,68 +706,655 @@ var GitHubBackend = class {
 		if (error?.type === "FORBIDDEN") throw new SignInError("cant-publish", "This GitHub account can't publish to the site.");
 		throw new GitApiError(422, `GitHub couldn't save the changes: ${error?.message ?? "unknown error"}`);
 	}
+	async history(path, { page = 1, perPage = 20 } = {}) {
+		const query = new URLSearchParams({
+			sha: this.pinned ?? await this.revision(),
+			path,
+			per_page: String(perPage),
+			page: String(page)
+		});
+		return (await githubJson(this.api, `/repos/${this.repo}/commits?${query}`)).map((commit) => ({
+			revision: commit.sha,
+			date: commit.commit.author?.date ?? "",
+			author: commit.commit.author?.name || commit.author?.login || void 0,
+			message: commit.commit.message.split("\n")[0] ?? ""
+		}));
+	}
+	async readAt(path, revision) {
+		return this.readFrom(await this.tree(revision), path);
+	}
 	async changedPaths(from, to) {
 		const comparison = await githubJson(this.api, `/repos/${this.repo}/compare/${from}...${to}`);
 		return [...new Set((comparison.files ?? []).flatMap((file) => [file.filename, file.previous_filename ?? []].flat()))];
 	}
 	/**
-	* Reads the deployment GitHub Pages or Vercel created for a commit. Before
-	* one exists, the site counts as building if it has ever been deployed.
+	* Reads the deployment GitHub Pages or Vercel created for a commit, and for
+	* GitHub Actions, the workflow run that builds it: a build that fails never
+	* creates a deployment. Before either exists, the site counts as building
+	* if it has ever been deployed.
 	*/
 	async deployStatus(revision) {
 		try {
 			const latest = (await githubJson(this.api, `/repos/${this.repo}/deployments?sha=${revision}&per_page=5`))[0];
-			if (!latest) return { state: (await githubJson(this.api, `/repos/${this.repo}/deployments?per_page=1`)).length > 0 ? "building" : "unknown" };
-			const [status] = await githubJson(this.api, `/repos/${this.repo}/deployments/${latest.id}/statuses?per_page=1`);
-			const detailsUrl = status?.log_url || status?.target_url || void 0;
-			switch (status?.state) {
-				case "success":
-				case "inactive": return {
-					state: "live",
-					detailsUrl
-				};
-				case "failure":
-				case "error": return {
-					state: "failed",
-					detailsUrl
-				};
-				default: return {
-					state: "building",
-					detailsUrl
-				};
+			if (latest) {
+				const [status] = await githubJson(this.api, `/repos/${this.repo}/deployments/${latest.id}/statuses?per_page=1`);
+				const detailsUrl = status?.log_url || status?.target_url || void 0;
+				switch (status?.state) {
+					case "success":
+					case "inactive": return {
+						state: "live",
+						detailsUrl
+					};
+					case "failure":
+					case "error": {
+						const run = await this.workflowRun(revision);
+						return {
+							state: "failed",
+							detailsUrl,
+							problem: run ? await this.runProblem(run) : { step: "deploy" }
+						};
+					}
+					default: return {
+						state: "building",
+						detailsUrl
+					};
+				}
 			}
+			const run = await this.workflowRun(revision);
+			if (run?.status === "completed" && run.conclusion !== "success" && run.conclusion !== "skipped") return {
+				state: "failed",
+				detailsUrl: run.html_url,
+				problem: await this.runProblem(run)
+			};
+			if (run) return {
+				state: "building",
+				detailsUrl: run.html_url
+			};
+			return { state: (await githubJson(this.api, `/repos/${this.repo}/deployments?per_page=1`)).length > 0 ? "building" : "unknown" };
 		} catch (error) {
 			if (error instanceof GitApiError) return { state: "unknown" };
 			throw error;
 		}
 	}
+	/** The site's deploy workflow run for a commit, or `undefined` if there's none or the token can't see Actions. */
+	async workflowRun(revision) {
+		const response = await githubRequest(this.api, `/repos/${this.repo}/actions/runs?head_sha=${revision}&per_page=20`, { allow: [403, 404] });
+		if (!response.ok) return void 0;
+		const { workflow_runs: runs = [] } = await response.json();
+		return runs.find((run) => /deploy|pages/i.test(`${run.path ?? ""} ${run.name ?? ""}`)) ?? runs[0];
+	}
+	/** Which step of a failed run failed. */
+	async runProblem(run) {
+		const response = await githubRequest(this.api, `/repos/${this.repo}/actions/runs/${run.id}/jobs?per_page=50`, { allow: [403, 404] });
+		const failed = (response.ok ? (await response.json()).jobs ?? [] : []).find((job) => job.conclusion === "failure");
+		if (!failed) return {
+			step: run.conclusion === "startup_failure" ? "not-started" : "host",
+			detail: run.conclusion ?? void 0
+		};
+		const step = failed.steps?.find((candidate) => candidate.conclusion === "failure");
+		if (!step) return {
+			step: "not-started",
+			detail: failed.name
+		};
+		return {
+			step: buildStepFor(step.name) ?? (/deploy/i.test(failed.name) ? "deploy" : "build"),
+			detail: `${failed.name}: ${step.name}`
+		};
+	}
 	signOut() {
+		this.ownerAccess.forget();
 		this.onSignOut();
 	}
 };
 //#endregion
+//#region src/sign-in.ts
+/**
+* Talking to the sign-in worker (`@goodfellow-cms/worker`), which signs
+* editors in with GitHub and gives the admin panel a token for the site's
+* repository, lasting an hour. Requests are sent as plain text, so browsers
+* send them straight away without asking the worker first.
+*/
+/** The sign-in worker Goodfellow runs for every site. Sites can run their own and name it in `github({ signIn })`. */
+const GOODFELLOW_SIGN_IN = "https://sign-in.goodfellow-cms.workers.dev";
+/** The worker's problems, as the admin panel's sign-in problems. */
+const PROBLEMS = {
+	invalid: "invalid",
+	"no-access": "no-access",
+	"cant-publish": "cant-publish",
+	cancelled: "redirect-failed",
+	"not-installed": "not-installed",
+	"no-address": "no-address",
+	"wrong-address": "wrong-address",
+	"local-address": "local-address",
+	"not-owner": "not-owner"
+};
+/** The worker's answer as a `SignInError`. */
+function signInProblem(answer) {
+	const problem = PROBLEMS[String(answer.problem)] ?? "unavailable";
+	const link = typeof answer.installUrl === "string" && /^https:\/\//.test(answer.installUrl) ? answer.installUrl : void 0;
+	return new SignInError(problem, `The sign-in service said: ${String(answer.problem ?? "no answer")}.`, link);
+}
+/** Addresses on the computer itself, which the worker never gives tokens to. */
+function isLocalAddress(href) {
+	let host;
+	try {
+		host = new URL(href).hostname.toLowerCase();
+	} catch {
+		return true;
+	}
+	return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "[::1]" || /^127(\.\d{1,3}){3}$/.test(host);
+}
+function base64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** A secret that never leaves this tab, and its hash, which the worker checks it against (PKCE's S256). */
+async function newVerifier() {
+	const verifier = base64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: base64Url(new Uint8Array(digest))
+	};
+}
+function browserLocation() {
+	if (typeof window === "undefined") return void 0;
+	return {
+		href: () => window.location.href,
+		assign: (url) => window.location.assign(url),
+		replace: (url) => window.history.replaceState(window.history.state, "", url)
+	};
+}
+/** Query parameters the worker comes back with. */
+const GRANT_PARAM = "goodfellow_sign_in";
+const ERROR_PARAM = "goodfellow_sign_in_error";
+var SignInService = class {
+	url;
+	fetcher;
+	constructor(url, fetcher) {
+		this.url = url.replace(/\/$/, "");
+		this.fetcher = fetcher;
+	}
+	async answer(path, init) {
+		let response;
+		try {
+			response = await this.fetcher(`${this.url}${path}`, init);
+		} catch (error) {
+			throw new SignInError("unavailable", `Couldn't reach the sign-in service: ${error.message}`);
+		}
+		const body = await response.json().catch(() => ({}));
+		if (!response.ok) throw signInProblem(body);
+		return body;
+	}
+	/** Posts JSON as plain text. */
+	post(path, body) {
+		return this.answer(path, {
+			method: "POST",
+			headers: { "content-type": "text/plain" },
+			body: JSON.stringify(body)
+		});
+	}
+	/** Posts JSON as plain text, and gives the answer whatever it is, for callers that explain problems of their own. */
+	async postAnswer(path, body) {
+		let response;
+		try {
+			response = await this.fetcher(`${this.url}${path}`, {
+				method: "POST",
+				headers: { "content-type": "text/plain" },
+				body: JSON.stringify(body)
+			});
+		} catch (error) {
+			throw new SignInError("unavailable", `Couldn't reach the sign-in service: ${error.message}`);
+		}
+		return {
+			ok: response.ok,
+			body: await response.json().catch(() => ({}))
+		};
+	}
+	/** Whether the worker is set up and answering. Throws `SignInError` if it isn't. */
+	async health() {
+		if ((await this.answer("/health")).ok !== true) throw new SignInError("unavailable", "The sign-in service isn't set up.");
+	}
+	/** Whether this page can sign in to the repository through the worker. Throws `SignInError` if it can't. */
+	async check(repo, purpose) {
+		await this.answer(`/github/check?${new URLSearchParams({
+			repo,
+			purpose
+		})}`);
+	}
+	/** Where to send the browser to sign in, or with `install`, to install Goodfellow and sign in. */
+	startUrl(options) {
+		const query = new URLSearchParams({
+			purpose: options.purpose,
+			...options.repo && { repo: options.repo },
+			return: options.back,
+			challenge: options.challenge,
+			remember: options.remember ? "1" : "0",
+			...options.install && { install: "1" }
+		});
+		return `${this.url}/github/start?${query}`;
+	}
+	/** Exchanges the grant the worker came back with, and this tab's verifier, for a session (and for a site, its first token). */
+	session(grant, verifier) {
+		return this.post("/github/session", {
+			grant,
+			verifier
+		});
+	}
+	token(session) {
+		return this.post("/github/token", { session });
+	}
+};
+/** A token that renews itself through the worker before it expires, or when GitHub stops accepting it. */
+function renewingToken(service, first, onRenew) {
+	let current = first;
+	let renewing;
+	return {
+		current: () => current,
+		async token({ refresh = false } = {}) {
+			if (refresh || Date.parse(current.expiresAt) - 3e5 < Date.now()) {
+				renewing ??= service.token(current.session).finally(() => {
+					renewing = void 0;
+				});
+				current = await renewing;
+				onRenew(current);
+			}
+			return current.token;
+		}
+	};
+}
+//#endregion
+//#region src/setup.ts
+/** The branch the deploy setups build from. */
+const MAIN = "main";
+/**
+* Links to GitHub's token pages with what creating a site needs: creating the
+* repository (administration), writing its files and its build setup
+* (contents and workflows), and turning on GitHub Pages (pages).
+*/
+function githubSetupTokenLinks(webUrl = "https://github.com") {
+	const fineGrained = new URLSearchParams({
+		name: "Goodfellow site setup",
+		description: "Create a Goodfellow site. It can be deleted once the site is created.",
+		expires_in: "7",
+		administration: "write",
+		contents: "write",
+		workflows: "write",
+		pages: "write"
+	});
+	const classic = new URLSearchParams({
+		scopes: "repo,workflow",
+		description: "Goodfellow site setup"
+	});
+	return {
+		fineGrained: `${webUrl}/settings/personal-access-tokens/new?${fineGrained}`,
+		classic: `${webUrl}/settings/tokens/new?${classic}`
+	};
+}
+/** The steps after the repository exists, which are the same however it was created. */
+function setupAccount(creator) {
+	/** Makes `main` the default branch, which the deploy setups build from. */
+	async function useMainBranch(api, repo) {
+		if (repo.default_branch === MAIN) return;
+		const base = `/repos/${repoPath(repo.full_name)}`;
+		const ref = await githubJson(api, `${base}/git/ref/heads/${repo.default_branch}`);
+		await githubRequest(api, `${base}/git/refs`, {
+			method: "POST",
+			body: {
+				ref: `refs/heads/${MAIN}`,
+				sha: ref.object.sha
+			}
+		});
+		await githubRequest(api, base, {
+			method: "PATCH",
+			body: { default_branch: MAIN }
+		});
+		await githubRequest(api, `${base}/git/refs/heads/${repo.default_branch}`, { method: "DELETE" });
+	}
+	/** Turns on GitHub Pages, published by the site's own workflow. Returns the site's address. */
+	async function turnOnPages(api, repo) {
+		try {
+			return (await githubJson(api, `/repos/${repoPath(repo.full_name)}/pages`, {
+				method: "POST",
+				body: { build_type: "workflow" }
+			})).html_url;
+		} catch (error) {
+			if (error instanceof GitApiError && [
+				403,
+				404,
+				409,
+				422
+			].includes(error.status)) return void 0;
+			throw error;
+		}
+	}
+	/** Writes every file in one commit, which replaces the starting README rather than following it. */
+	async function writeFiles(api, repo, site) {
+		const base = `/repos/${repoPath(repo.full_name)}`;
+		const tree = [];
+		for (const file of site.files) {
+			if ("delete" in file) continue;
+			if ("content" in file) {
+				tree.push({
+					path: file.path,
+					mode: "100644",
+					type: "blob",
+					content: file.content
+				});
+				continue;
+			}
+			const blob = await githubJson(api, `${base}/git/blobs`, {
+				method: "POST",
+				body: {
+					content: encodeBase64Bytes(file.bytes),
+					encoding: "base64"
+				}
+			});
+			tree.push({
+				path: file.path,
+				mode: "100644",
+				type: "blob",
+				sha: blob.sha
+			});
+		}
+		try {
+			const created = await githubJson(api, `${base}/git/trees`, {
+				method: "POST",
+				body: { tree }
+			});
+			const commit = await githubJson(api, `${base}/git/commits`, {
+				method: "POST",
+				body: {
+					message: site.message,
+					tree: created.sha,
+					parents: [],
+					...creator.author && { author: {
+						...creator.author,
+						date: (/* @__PURE__ */ new Date()).toISOString()
+					} }
+				}
+			});
+			await githubRequest(api, `${base}/git/refs/heads/${MAIN}`, {
+				method: "PATCH",
+				body: {
+					sha: commit.sha,
+					force: true
+				}
+			});
+		} catch (error) {
+			if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SetupError("not-allowed", "This sign-in can't write the site's files, or its build setup.");
+			throw error;
+		}
+	}
+	/** Stops anyone rewriting or deleting the main branch's history. Not every plan allows it. */
+	async function protectMain(api, repo) {
+		return (await githubRequest(api, `/repos/${repoPath(repo.full_name)}/rulesets`, {
+			method: "POST",
+			body: {
+				name: "Protect the published history",
+				target: "branch",
+				enforcement: "active",
+				conditions: { ref_name: {
+					include: ["~DEFAULT_BRANCH"],
+					exclude: []
+				} },
+				rules: [{ type: "non_fast_forward" }, { type: "deletion" }]
+			},
+			allow: [
+				403,
+				404,
+				422
+			]
+		})).ok;
+	}
+	return {
+		user: creator.user,
+		owners: () => creator.owners(),
+		isAvailable: (owner, name) => creator.isAvailable(owner, name),
+		async createSite(site, onStep) {
+			const warnings = [];
+			onStep?.("repository");
+			const { repo, api, signInInstallUrl } = await creator.create(site);
+			await useMainBranch(api, repo);
+			let siteUrl;
+			if (site.pages) {
+				onStep?.("pages");
+				siteUrl = await turnOnPages(api, repo);
+				if (!siteUrl) warnings.push("pages-unavailable");
+			}
+			onStep?.("files");
+			await writeFiles(api, repo, site);
+			onStep?.("protection");
+			if (!await protectMain(api, repo)) warnings.push("protection-unavailable");
+			if (signInInstallUrl) warnings.push("sign-in-not-installed");
+			return {
+				repo: repo.full_name,
+				webUrl: repo.html_url,
+				siteUrl,
+				buildsUrl: `${repo.html_url}/actions`,
+				pagesUrl: site.pages ? `${repo.html_url}/settings/pages` : void 0,
+				...signInInstallUrl && { signInInstallUrl },
+				warnings
+			};
+		}
+	};
+}
+/** Creating repositories with the person's own token. */
+async function tokenCreator(api) {
+	const user = await githubJson(api, "/user");
+	async function isAvailable(owner, name) {
+		return (await githubRequest(api, `/repos/${repoPath(`${owner.path}/${name}`)}`, { allow: [404] })).status === 404;
+	}
+	return {
+		user: {
+			login: user.login,
+			name: user.name ?? void 0,
+			avatarUrl: user.avatar_url
+		},
+		async owners() {
+			return [{
+				path: user.login,
+				name: user.name || user.login,
+				kind: "personal"
+			}, ...(await githubJson(api, "/user/orgs?per_page=100").catch(() => [])).map((org) => ({
+				path: org.login,
+				name: org.login,
+				kind: "organization"
+			}))];
+		},
+		isAvailable,
+		async create(site) {
+			const path = site.owner.kind === "personal" ? "/user/repos" : `/orgs/${encodeURIComponent(site.owner.path)}/repos`;
+			if (!await isAvailable(site.owner, site.name)) throw new SetupError("name-taken", `There's already a repository called ${site.owner.path}/${site.name}.`);
+			try {
+				return {
+					repo: await githubJson(api, path, {
+						method: "POST",
+						body: {
+							name: site.name,
+							private: site.private,
+							description: site.description,
+							auto_init: true
+						}
+					}),
+					api
+				};
+			} catch (error) {
+				if (error instanceof GitApiError && error.status === 422) throw new SetupError("name-invalid", `GitHub can't use "${site.name}" as a repository name.`);
+				if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SetupError("not-allowed", `This sign-in can't create repositories in ${site.owner.path}.`);
+				throw error;
+			}
+		}
+	};
+}
+/**
+* Creating repositories through the sign-in worker, which uses the person's
+* GitHub token itself and gives back a token for the new repository only.
+*/
+function workerCreator(service, apiUrl, fetcher, signedIn) {
+	let session = signedIn.session;
+	async function call(path, body) {
+		const answer = await service.postAnswer(path, {
+			session,
+			...body
+		});
+		if (typeof answer.body.session === "string") session = answer.body.session;
+		if (!answer.ok) throw setupProblem(answer.body);
+		return answer.body;
+	}
+	const { user } = signedIn;
+	return {
+		user: {
+			login: user.login,
+			name: user.name,
+			avatarUrl: user.avatarUrl
+		},
+		author: {
+			name: user.name || user.login,
+			email: user.email
+		},
+		async owners() {
+			const found = await call("/github/setup/owners", {});
+			return (found.owners ?? []).map(({ installed, ...owner }) => ({
+				...owner,
+				...!installed && found.installUrl && { installUrl: found.installUrl }
+			}));
+		},
+		async isAvailable(owner, name) {
+			return (await call("/github/setup/available", {
+				owner: owner.path,
+				name
+			})).available === true;
+		},
+		async create(site) {
+			if (site.owner.installUrl) throw new SetupError("not-installed", `Goodfellow isn't installed on ${site.owner.path}.`, site.owner.installUrl);
+			const created = await call("/github/setup/repository", {
+				owner: site.owner.path,
+				name: site.name,
+				private: site.private,
+				description: site.description
+			});
+			if (!created.repo || !created.token) throw new SignInError("unavailable", "The sign-in service didn't answer.");
+			return {
+				repo: created.repo,
+				api: {
+					apiUrl,
+					token: created.token,
+					fetch: fetcher
+				},
+				...created.editInstallUrl && { signInInstallUrl: created.editInstallUrl }
+			};
+		}
+	};
+}
+/** The worker's answer when it couldn't create the repository, as a `SetupError` or `SignInError`. */
+function setupProblem(answer) {
+	switch (answer.problem) {
+		case "name-taken": return new SetupError("name-taken", "There's already a repository with that name.");
+		case "name-invalid": return new SetupError("name-invalid", "GitHub can't use that as a repository name.");
+		case "not-allowed": return new SetupError("not-allowed", "This sign-in can't create repositories there.");
+		case "not-installed": return new SetupError("not-installed", "Goodfellow isn't installed there.", answer.installUrl);
+		default: return signInProblem(answer);
+	}
+}
+/** Signing in to GitHub to create a site's repository, with GitHub Pages if wanted. */
+function githubSetup(options = {}) {
+	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const links = githubSetupTokenLinks(options.webUrl);
+	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	const location = options.location ?? browserLocation();
+	const signInUrl = options.signIn === void 0 ? GOODFELLOW_SIGN_IN : options.signIn;
+	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
+	const pending = credentialStorage("goodfellow:github:setup:pending", options.storage);
+	return {
+		name: "GitHub",
+		canRedirect: service !== void 0,
+		tokenLinks: [{
+			url: links.fineGrained,
+			label: "signIn.token.create"
+		}, {
+			url: links.classic,
+			label: "signIn.token.createBroad",
+			hint: "signIn.token.createBroadHint"
+		}],
+		async restore() {
+			if (!location) return null;
+			const url = new URL(location.href());
+			const grant = url.searchParams.get(GRANT_PARAM);
+			const failed = url.searchParams.get(ERROR_PARAM);
+			if (!grant && !failed) return null;
+			url.searchParams.delete(GRANT_PARAM);
+			url.searchParams.delete(ERROR_PARAM);
+			location.replace(url.toString());
+			const verifier = pending.load();
+			pending.clear();
+			if (failed || !grant || !verifier || !service) throw signInProblem({ problem: failed ?? "cancelled" });
+			const signedIn = await service.session(grant, verifier);
+			return setupAccount(workerCreator(service, apiUrl, fetcher, signedIn));
+		},
+		async signInWithToken(token) {
+			const trimmed = token.trim();
+			if (!trimmed) throw new SignInError("invalid", "Paste a token to sign in.");
+			return setupAccount(await tokenCreator({
+				apiUrl,
+				token: trimmed,
+				fetch: fetcher
+			}));
+		},
+		async startRedirect({ install } = {}) {
+			if (!service || !location) throw new SignInError("unavailable", "Signing in with GitHub isn't available here.");
+			await service.health();
+			const { verifier, challenge } = await newVerifier();
+			pending.save(verifier, false);
+			location.assign(service.startUrl({
+				purpose: "setup",
+				back: location.href(),
+				challenge,
+				remember: false,
+				install
+			}));
+		}
+	};
+}
+//#endregion
 //#region src/index.ts
+/** Saved sign-ins to forget when they stop working: not when the worker can't be reached, which passes. */
+function forgets(error) {
+	return error instanceof SignInError && error.problem !== "unavailable";
+}
 /**
 * Links to GitHub's token page with everything filled in except the
 * repository, which GitHub doesn't let links choose.
 */
 function githubTokenLinks(repo, webUrl = "https://github.com") {
-	const [owner = ""] = repo.split("/");
+	const [repoOwner = ""] = repo.split("/");
 	const fineGrained = new URLSearchParams({
 		name: "Goodfellow admin",
 		description: `Edit ${repo} in its admin panel`,
-		target_name: owner,
+		target_name: repoOwner,
 		expires_in: "90",
 		contents: "write",
-		deployments: "read"
+		deployments: "read",
+		actions: "read"
 	});
 	const classic = new URLSearchParams({
 		scopes: "repo",
 		description: `Goodfellow admin for ${repo}`
 	});
+	const owner = new URLSearchParams({
+		name: "Goodfellow owner",
+		description: `Manage the editors, domain and updates of ${repo}`,
+		target_name: repoOwner,
+		expires_in: "1",
+		administration: "write",
+		pages: "write",
+		actions: "write"
+	});
 	return {
 		fineGrained: `${webUrl}/settings/personal-access-tokens/new?${fineGrained}`,
-		classic: `${webUrl}/settings/tokens/new?${classic}`
+		classic: `${webUrl}/settings/tokens/new?${classic}`,
+		owner: `${webUrl}/settings/personal-access-tokens/new?${owner}`
 	};
 }
 /** Sign-in and storage for a site whose repository is on GitHub. */
@@ -201,11 +1363,151 @@ function github(options) {
 	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
 	const links = githubTokenLinks(options.repo, options.webUrl);
 	const storage = credentialStorage(`goodfellow:github:${options.repo}`, options.storage);
+	const pending = credentialStorage(`goodfellow:github:pending:${options.repo}`, options.storage);
+	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	const location = options.location ?? browserLocation();
+	const signInUrl = options.signIn === void 0 ? GOODFELLOW_SIGN_IN : options.signIn;
+	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
+	function save(value, remember) {
+		storage.save(value.type === "token" ? value.token : JSON.stringify(value), remember);
+	}
+	function loadSaved() {
+		const value = storage.load();
+		if (!value) return void 0;
+		try {
+			const parsed = JSON.parse(value);
+			if (parsed.type === "worker" || parsed.type === "token") return parsed;
+		} catch {}
+		return {
+			type: "token",
+			token: value
+		};
+	}
+	/**
+	* Sends the browser to GitHub through the worker, which comes back to this
+	* screen. With `install`, GitHub's install page installs Goodfellow first.
+	*/
+	async function redirect(purpose, remember, { install } = {}) {
+		if (!service || !location) throw new SignInError("unavailable", "Signing in with GitHub isn't available here.");
+		if (!install) await service.check(options.repo, purpose);
+		const { verifier, challenge } = await newVerifier();
+		pending.save(JSON.stringify({
+			verifier,
+			purpose,
+			remember
+		}), false);
+		location.assign(service.startUrl({
+			purpose,
+			repo: options.repo,
+			back: location.href(),
+			challenge,
+			remember,
+			install
+		}));
+	}
+	/** Connects with a session from the worker, whose tokens renew themselves. */
+	async function connectWorker(issued, remember) {
+		const source = renewingToken(service, issued, (renewed) => save({
+			type: "worker",
+			session: renewed.session
+		}, remember));
+		save({
+			type: "worker",
+			session: issued.session
+		}, remember);
+		const api = {
+			apiUrl,
+			token: source.token,
+			fetch: fetcher
+		};
+		const repo = await githubJson(api, `/repos/${repoPath(options.repo)}`);
+		const { user } = issued;
+		return new GitHubBackend({
+			api,
+			repo: options.repo,
+			branch: options.branch ?? repo.default_branch,
+			user: {
+				login: user.login,
+				name: user.name,
+				avatarUrl: user.avatarUrl
+			},
+			author: {
+				name: user.name || user.login,
+				email: user.email
+			},
+			onSignOut: () => {
+				storage.clear();
+				revokeToken(source.current().token);
+			},
+			ownerTokenLink: {
+				url: links.owner,
+				label: "owner.token.create"
+			},
+			ownerRedirect: (redirectOptions) => redirect("owner", false, redirectOptions)
+		});
+	}
+	/** Revokes a token the worker gave, as signing out does. Never fails: signing out goes ahead regardless. */
+	function revokeToken(token) {
+		githubRequest({
+			apiUrl,
+			token,
+			fetch: fetcher
+		}, "/installation/token", { method: "DELETE" }).catch(() => {});
+	}
+	/** Gives the backend an owner's sign-in that has just come back from GitHub. It's kept in memory only. */
+	async function useOwner(backend, grant, verifier) {
+		const worker = service;
+		try {
+			const source = renewingToken(worker, await worker.session(grant, verifier), () => {});
+			backend.useOwnerSignIn(source.token, () => revokeToken(source.current().token));
+		} catch (error) {
+			backend.ownerSignInFailed(error);
+		}
+	}
+	/** Finishes a sign-in through the worker if the page has just come back from it. */
+	async function completeRedirect() {
+		if (!location) return void 0;
+		const url = new URL(location.href());
+		const grant = url.searchParams.get(GRANT_PARAM);
+		const failed = url.searchParams.get(ERROR_PARAM);
+		if (!grant && !failed) return void 0;
+		url.searchParams.delete(GRANT_PARAM);
+		url.searchParams.delete(ERROR_PARAM);
+		location.replace(url.toString());
+		const saved = pending.load();
+		pending.clear();
+		const redirect = saved ? JSON.parse(saved) : void 0;
+		if (!redirect || !service) throw new SignInError("redirect-failed", "Signing in with GitHub didn't finish in this tab.");
+		if (redirect.purpose === "owner") {
+			const backend = await restoreSaved();
+			if (!backend) throw new SignInError("redirect-failed", "Sign in again, then sign in as an owner.");
+			if (failed) backend.ownerSignInFailed(signInProblem({ problem: failed }));
+			else if (grant) await useOwner(backend, grant, redirect.verifier);
+			return backend;
+		}
+		if (failed || !grant) throw signInProblem({ problem: failed });
+		return connectWorker(await service.session(grant, redirect.verifier), redirect.remember);
+	}
+	async function restoreSaved() {
+		const saved = loadSaved();
+		if (!saved) return null;
+		try {
+			if (saved.type === "token") return await connect(saved.token);
+			if (!service) {
+				storage.clear();
+				return null;
+			}
+			return await connectWorker(await service.token(saved.session), storage.remembered());
+		} catch (error) {
+			if (forgets(error)) storage.clear();
+			throw error;
+		}
+	}
 	async function connect(token) {
 		const api = {
 			apiUrl,
 			token,
-			fetch: options.fetch ?? globalThis.fetch.bind(globalThis)
+			fetch: fetcher
 		};
 		const user = await githubJson(api, "/user");
 		let repo;
@@ -225,12 +1527,17 @@ function github(options) {
 				name: user.name ?? void 0,
 				avatarUrl: user.avatar_url
 			},
-			onSignOut: () => storage.clear()
+			onSignOut: () => storage.clear(),
+			ownerTokenLink: {
+				url: links.owner,
+				label: "owner.token.create"
+			},
+			...service && { ownerRedirect: (redirectOptions) => redirect("owner", false, redirectOptions) }
 		});
 	}
 	return {
 		name: "GitHub",
-		canRedirect: false,
+		canRedirect: service !== void 0,
 		tokenLinks: [{
 			url: links.fineGrained,
 			label: "signIn.token.create"
@@ -240,26 +1547,24 @@ function github(options) {
 			hint: "signIn.token.createBroadHint"
 		}],
 		async restore() {
-			const token = storage.load();
-			if (!token) return null;
-			try {
-				return await connect(token);
-			} catch (error) {
-				if (error instanceof SignInError) storage.clear();
-				throw error;
-			}
+			const redirected = await completeRedirect();
+			if (redirected !== void 0) return redirected;
+			return restoreSaved();
 		},
 		async signInWithToken(token, remember) {
 			const trimmed = token.trim();
 			if (!trimmed) throw new SignInError("invalid", "Paste a token to sign in.");
 			const backend = await connect(trimmed);
-			storage.save(trimmed, remember);
+			save({
+				type: "token",
+				token: trimmed
+			}, remember);
 			return backend;
 		},
-		async startRedirect() {
-			throw new Error("Signing in by redirect needs a sign-in server, which isn't supported for GitHub yet.");
+		startRedirect(remember, redirectOptions) {
+			return redirect("edit", remember, redirectOptions);
 		}
 	};
 }
 //#endregion
-export { GitHubBackend, github, githubTokenLinks };
+export { GOODFELLOW_SIGN_IN, GitHubBackend, github, githubPagesRecords, githubSetup, githubSetupTokenLinks, githubTokenLinks };