@goodfellow-cms/github 0.2.0 → 0.4.0

package/dist/index.js

@@ -1,18 +1,20 @@
-import { ConflictError, DomainError, EditorsError, GitApiError, SetupError, SignInError, UpdatesError, buildStepFor, compareReleases, credentialStorage, encodeBase64, encodeBase64Bytes, siteVersion } from "@goodfellow-cms/core";
+import { ConflictError, DomainError, DraftError, EditorsError, GitApiError, REBUILD_JOB, SetupError, SignInError, UpdatesError, assertContentChanges, branchDrafts, buildStepFor, compareReleases, credentialStorage, decodeBase64, encodeBase64, encodeBase64Bytes, siteVersion } from "@goodfellow-cms/core";
 //#region src/api.ts
 /** Calls the GitHub REST or GraphQL API. Treats 401 as an expired sign-in; other errors become `GitApiError`. */
 async function githubRequest({ apiUrl, token, fetch }, path, init = {}) {
-	const response = await fetch(`${apiUrl}${path}`, {
+	const send = async (refresh) => fetch(`${apiUrl}${path}`, {
 		method: init.method ?? "GET",
 		headers: {
 			accept: init.accept ?? "application/vnd.github+json",
-			authorization: `Bearer ${token}`,
+			authorization: `Bearer ${typeof token === "string" ? token : await token({ refresh })}`,
 			"x-github-api-version": "2022-11-28",
 			...init.body !== void 0 && { "content-type": "application/json" }
 		},
 		body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
 		cache: "no-store"
 	});
+	let response = await send(false);
+	if (response.status === 401 && typeof token !== "string") response = await send(true);
 	if (response.status === 401) throw new SignInError("invalid", "GitHub didn't accept the sign-in. It may have expired.");
 	if (!response.ok && !init.allow?.includes(response.status)) {
 		const body = await response.json().catch(() => ({}));
@@ -139,15 +141,30 @@ function githubEditors(read, manage, repo, login) {
 		}
 	};
 }
-/** The owner token: GitHub's Administration and Pages permissions, for this tab only. */
-function githubOwnerAccess(base, repo, tokenLink) {
+/**
+* The owner token: GitHub's Administration and Pages permissions, for this tab
+* only. With the sign-in worker, owners can sign in with its owners' app
+* instead (`redirect`), and `useSignIn()` gives the token that comes back.
+*/
+function githubOwnerAccess(base, repo, tokenLink, redirect) {
 	let owner;
+	/** The owner's access to the site's code repository, where its content is kept in a repository of its own. */
+	let ownerCode;
+	let endSignIn;
+	let problem;
 	return {
 		access: {
 			tokenLink,
 			get active() {
 				return owner !== void 0;
 			},
+			get problem() {
+				return problem;
+			},
+			...redirect && { async startRedirect(options) {
+				problem = void 0;
+				await redirect(options);
+			} },
 			async applyToken(token) {
 				const api = {
 					...base,
@@ -162,12 +179,35 @@ function githubOwnerAccess(base, repo, tokenLink) {
 					throw error;
 				}
 				owner = api;
+				ownerCode = api;
+				problem = void 0;
 			},
 			forget() {
 				owner = void 0;
+				ownerCode = void 0;
+				endSignIn?.();
+				endSignIn = void 0;
 			}
 		},
-		api: () => owner
+		api: () => owner,
+		codeApi: () => ownerCode,
+		/** Uses an owner's sign-in through the worker, with its token for the code repository if it gave one. `end` runs when it's forgotten. */
+		useSignIn(token, end, codeToken) {
+			owner = {
+				...base,
+				token
+			};
+			ownerCode = codeToken ? {
+				...base,
+				token: codeToken
+			} : void 0;
+			endSignIn = end;
+			problem = void 0;
+		},
+		/** Remembers why an owner's sign-in didn't work, for the screen that started it to show. */
+		failed(error) {
+			problem = error;
+		}
 	};
 }
 //#endregion
@@ -291,17 +331,19 @@ function githubPages(api, repo) {
 //#region src/updates.ts
 /** The starters' GitHub Pages workflow, which runs `goodfellow update` each night and when it's dispatched. */
 const WORKFLOW = "deploy.yml";
-const WORKFLOW_FILE = `.github/workflows/${WORKFLOW}`;
+/** The code repository's workflow, where a site keeps its content in a repository of its own. */
+const CODE_WORKFLOW = "update.yml";
 /**
 * The site's nightly update, which runs in its GitHub Pages workflow. Running
 * it now dispatches the workflow, which needs GitHub's Actions permission
 * with write access: `manage()` gives the owner token when one is in use.
 */
-function githubUpdates(read, manage, repo, branch, files) {
-	const path = `/repos/${repo}/actions/workflows/${WORKFLOW}`;
+function githubUpdates(read, manage, repo, branch, files, workflow = WORKFLOW) {
+	const path = `/repos/${repo}/actions/workflows/${workflow}`;
+	const workflowFile = `.github/workflows/${workflow}`;
 	return {
 		async setup() {
-			return (await files.read(WORKFLOW_FILE))?.includes("update --publish") ? "ready" : "missing";
+			return (await files.read(workflowFile))?.includes("update --publish") ? "ready" : "missing";
 		},
 		async lastRun() {
 			const response = await githubRequest(read, `${path}/runs?branch=${encodeURIComponent(branch)}&per_page=20`, { allow: [403, 404] });
@@ -359,8 +401,77 @@ function githubUpdates(read, manage, repo, branch, files) {
 		}
 	};
 }
+/** Whether an error means the sign-in can't see the code repository, or has no token for it. */
+function noAccess(error) {
+	return error instanceof SignInError && error.problem === "no-access" || error instanceof GitApiError && (error.status === 403 || error.status === 404);
+}
+/**
+* The nightly update of a site whose content is kept in a repository of its
+* own, which runs in the code repository's `update.yml`. The sign-in needs to
+* see the code repository too; where it can't, `setup()` says `no-access`.
+*/
+function githubCodeUpdates(options) {
+	const { read } = options;
+	const repo = repoPath(options.repo);
+	let branch;
+	const liveBranch = (api) => {
+		branch ??= githubJson(api, `/repos/${repo}`).then((found) => found.default_branch);
+		branch.catch(() => {
+			branch = void 0;
+		});
+		return branch;
+	};
+	/** The code repository at its newest commit, read again each time, since updates change it. */
+	async function files() {
+		if (!read) throw new SignInError("no-access", `This sign-in has no access to ${options.repo}.`);
+		return options.open(read, await liveBranch(read));
+	}
+	/** A file as it is now: setup files are outside the folders backends list, so they're read at the newest commit. */
+	async function readNow(path) {
+		const backend = await files();
+		return backend.readAt(path, await backend.revision());
+	}
+	async function updates() {
+		if (!read) throw new SignInError("no-access", `This sign-in has no access to ${options.repo}.`);
+		const target = await liveBranch(read);
+		return githubUpdates(read, options.manage, repo, target, {
+			read: readNow,
+			readAt: async (path, revision) => (await files()).readAt(path, revision)
+		}, CODE_WORKFLOW);
+	}
+	return {
+		code: {
+			repo: options.repo,
+			webUrl: `${options.webUrl}/${options.repo}`,
+			read: readNow,
+			history: async (path, history) => (await files()).history(path, history),
+			readAt: async (path, revision) => (await files()).readAt(path, revision)
+		},
+		async setup() {
+			try {
+				return await (await updates()).setup();
+			} catch (error) {
+				if (noAccess(error)) return "no-access";
+				throw error;
+			}
+		},
+		async lastRun() {
+			try {
+				return await (await updates()).lastRun();
+			} catch (error) {
+				if (noAccess(error)) return void 0;
+				throw error;
+			}
+		},
+		async start(target) {
+			await (await updates()).start(target);
+		}
+	};
+}
 //#endregion
 //#region src/backend.ts
+/** How many files one GraphQL request reads. */
+const GRAPHQL_BATCH = 100;
 const COMMIT_MUTATION = `mutation ($input: CreateCommitOnBranchInput!) {
   createCommitOnBranch(input: $input) { commit { oid } }
 }`;
@@ -369,30 +480,117 @@ const COMMIT_MUTATION = `mutation ($input: CreateCommitOnBranchInput!) {
 * returned; saves are single commits made with GraphQL's `createCommitOnBranch`,
 * which fails if the branch has moved, so nothing is ever overwritten.
 */
-var GitHubBackend = class {
+var GitHubBackend = class GitHubBackend {
 	user;
 	pages;
 	editors;
 	ownerAccess;
+	/** Absent where the repository holds only content: the update job runs where the code is. */
 	updates;
+	drafts;
+	contentOnly;
+	options;
 	api;
 	repo;
 	branch;
 	onSignOut;
+	author;
+	owner;
 	pinned;
 	trees = /* @__PURE__ */ new Map();
+	/** Each file's size in bytes at a commit, which GitHub lists with its tree. */
+	treeSizes = /* @__PURE__ */ new Map();
 	blobs = /* @__PURE__ */ new Map();
 	constructor(options) {
+		this.options = options;
 		this.api = options.api;
 		this.repo = repoPath(options.repo);
 		this.branch = options.branch;
 		this.user = options.user;
 		this.onSignOut = options.onSignOut;
-		const owner = githubOwnerAccess(this.api, this.repo, options.ownerTokenLink);
+		this.author = options.author;
+		this.pinned = options.revision;
+		const owner = githubOwnerAccess(this.api, this.repo, options.ownerTokenLink, options.ownerRedirect);
+		this.owner = owner;
 		this.ownerAccess = owner.access;
 		this.pages = githubPages(() => owner.api() ?? this.api, this.repo);
 		this.editors = githubEditors(this.api, owner.api, this.repo, this.user.login);
-		this.updates = githubUpdates(this.api, owner.api, this.repo, this.branch, this);
+		this.contentOnly = options.contentOnly === true;
+		if (!this.contentOnly) this.updates = githubUpdates(this.api, owner.api, this.repo, this.branch, this);
+		else if (options.code) this.updates = githubCodeUpdates({
+			repo: options.code.repo,
+			webUrl: options.code.webUrl,
+			read: options.code.api,
+			manage: owner.codeApi,
+			open: (api, branch) => new GitHubBackend({
+				api,
+				repo: options.code?.repo ?? "",
+				branch,
+				user: this.user,
+				onSignOut: () => {},
+				ownerTokenLink: options.ownerTokenLink
+			})
+		});
+		this.drafts = branchDrafts(this, this.draftHost());
+	}
+	/** Drafts on branches of the repository, with pull requests for review. */
+	draftHost() {
+		const base = `/repos/${this.repo}`;
+		const ref = (branch) => `${base}/git/refs/heads/${encodeURIComponent(branch)}`;
+		return {
+			liveBranch: this.branch,
+			branchStore: (branch) => new GitHubBackend({
+				...this.options,
+				branch
+			}),
+			createBranch: async (branch, revision) => {
+				if ((await githubRequest(this.api, `${base}/git/refs`, {
+					method: "POST",
+					body: {
+						ref: `refs/heads/${branch}`,
+						sha: revision
+					},
+					allow: [422]
+				})).status === 422) throw new DraftError("exists", `There's already a draft called ${branch}.`);
+			},
+			deleteBranch: async (branch) => {
+				await githubRequest(this.api, ref(branch), {
+					method: "DELETE",
+					allow: [404, 422]
+				});
+			},
+			mergeBase: async (branch) => {
+				const response = await githubRequest(this.api, `${base}/compare/${encodeURIComponent(this.branch)}...${encodeURIComponent(branch)}`, { allow: [404] });
+				if (response.status === 404) throw new DraftError("not-found", `There's no draft ${branch}.`);
+				return (await response.json()).merge_base_commit.sha;
+			},
+			openReview: async ({ branch, title, description }) => {
+				const response = await githubRequest(this.api, `${base}/pulls`, {
+					method: "POST",
+					body: {
+						title,
+						head: branch,
+						base: this.branch,
+						body: description
+					},
+					allow: [
+						403,
+						404,
+						422
+					]
+				});
+				if (response.ok) return { url: (await response.json()).html_url };
+				if (response.status !== 422) throw new DraftError("no-reviews", "This sign-in can't open pull requests on the site's repository.");
+				const owner = decodeURIComponent(this.repo).split("/")[0];
+				const query = new URLSearchParams({
+					head: `${owner}:${branch}`,
+					state: "open"
+				});
+				const [open] = await githubJson(this.api, `${base}/pulls?${query}`);
+				if (!open) throw new GitApiError(422, "GitHub couldn't open the pull request.");
+				return { url: open.html_url };
+			}
+		};
 	}
 	async revision() {
 		const ref = await githubJson(this.api, `/repos/${this.repo}/git/ref/heads/${encodeURIComponent(this.branch)}`);
@@ -405,7 +603,9 @@ var GitHubBackend = class {
 		if (!tree) {
 			tree = githubJson(this.api, `/repos/${this.repo}/git/trees/${sha}?recursive=1`).then((response) => {
 				if (response.truncated) throw new GitApiError(413, "The repository has too many files for GitHub to list at once.");
-				return new Map(response.tree.filter((entry) => entry.type === "blob").map((entry) => [entry.path, entry.sha]));
+				const blobs = response.tree.filter((entry) => entry.type === "blob");
+				this.treeSizes.set(sha, new Map(blobs.flatMap((entry) => entry.size === void 0 ? [] : [[entry.path, entry.size]])));
+				return new Map(blobs.map((entry) => [entry.path, entry.sha]));
 			});
 			tree.catch(() => this.trees.delete(sha));
 			this.trees.set(sha, tree);
@@ -429,6 +629,40 @@ var GitHubBackend = class {
 		}
 		return blob;
 	}
+	/** Reads many text files in a few GraphQL requests rather than one request each. */
+	async readFiles(paths) {
+		const tree = await this.currentTree();
+		const wanted = paths.flatMap((path) => {
+			const sha = tree.get(path);
+			return sha ? [[path, sha]] : [];
+		});
+		const fetch = [...new Set(wanted.map(([, sha]) => sha).filter((sha) => !this.blobs.has(sha)))];
+		const [owner, name] = decodeURIComponent(this.repo).split("/");
+		for (let start = 0; start < fetch.length; start += GRAPHQL_BATCH) {
+			const batch = fetch.slice(start, start + GRAPHQL_BATCH);
+			const fields = batch.map((sha, index) => `f${index}: object(oid: "${sha}") { ... on Blob { text isBinary } }`);
+			const response = await githubJson(this.api, "/graphql", {
+				method: "POST",
+				body: {
+					query: `query ($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { ${fields.join(" ")} } }`,
+					variables: {
+						owner,
+						name
+					}
+				}
+			});
+			batch.forEach((sha, index) => {
+				const blob = response.data?.repository?.[`f${index}`];
+				if (blob && !blob.isBinary && typeof blob.text === "string") this.blobs.set(sha, Promise.resolve(blob.text));
+			});
+		}
+		const result = /* @__PURE__ */ new Map();
+		for (const [path] of wanted) {
+			const text = await this.readFrom(tree, path);
+			if (text !== void 0) result.set(path, text);
+		}
+		return result;
+	}
 	async readBytes(path) {
 		const sha = (await this.currentTree()).get(path);
 		if (!sha) return void 0;
@@ -439,7 +673,101 @@ var GitHubBackend = class {
 		const prefix = `${dir}/`;
 		return [...(await this.currentTree()).keys()].filter((path) => path.startsWith(prefix)).sort();
 	}
-	async write(changes, { message, expectedRevision }) {
+	async fileSizes(dir) {
+		const prefix = `${dir}/`;
+		await this.currentTree();
+		const sizes = this.treeSizes.get(this.pinned ?? "") ?? /* @__PURE__ */ new Map();
+		return new Map([...sizes].filter(([path]) => path.startsWith(prefix)));
+	}
+	/** Uses an owner's sign-in through the worker for editors and GitHub Pages settings, until it's forgotten. */
+	useOwnerSignIn(token, end, codeToken) {
+		this.owner.useSignIn(token, end, codeToken);
+	}
+	/** Remembers why an owner's sign-in through the worker didn't work, which the Editors and Domain screens show. */
+	ownerSignInFailed(error) {
+		this.owner.failed(error);
+	}
+	async write(changes, options) {
+		if (this.contentOnly) assertContentChanges(changes);
+		return this.author ? this.writeCommit(changes, options, this.author) : this.writeGraphQL(changes, options);
+	}
+	/**
+	* Saves with Git's data API, naming the editor as the commit's author:
+	* GitHub refuses to move the branch unless the commit follows on from it, so
+	* nothing is overwritten.
+	*/
+	async writeCommit(changes, { message, expectedRevision }, author) {
+		const existing = await this.tree(expectedRevision);
+		const base = `/repos/${this.repo}`;
+		const entries = [];
+		try {
+			for (const change of changes) if ("delete" in change) {
+				if (existing.has(change.path)) entries.push({
+					path: change.path,
+					mode: "100644",
+					type: "blob",
+					sha: null
+				});
+			} else if ("bytes" in change) {
+				const blob = await githubJson(this.api, `${base}/git/blobs`, {
+					method: "POST",
+					body: {
+						content: encodeBase64Bytes(change.bytes),
+						encoding: "base64"
+					}
+				});
+				entries.push({
+					path: change.path,
+					mode: "100644",
+					type: "blob",
+					sha: blob.sha
+				});
+			} else entries.push({
+				path: change.path,
+				mode: "100644",
+				type: "blob",
+				content: change.content
+			});
+			if (entries.length === 0) return { revision: expectedRevision };
+			const parent = await githubJson(this.api, `${base}/git/commits/${expectedRevision}`);
+			const tree = await githubJson(this.api, `${base}/git/trees`, {
+				method: "POST",
+				body: {
+					base_tree: parent.tree.sha,
+					tree: entries
+				}
+			});
+			const commit = await githubJson(this.api, `${base}/git/commits`, {
+				method: "POST",
+				body: {
+					message,
+					tree: tree.sha,
+					parents: [expectedRevision],
+					author: {
+						...author,
+						date: (/* @__PURE__ */ new Date()).toISOString()
+					}
+				}
+			});
+			if ((await githubRequest(this.api, `${base}/git/refs/heads/${encodeURIComponent(this.branch)}`, {
+				method: "PATCH",
+				body: {
+					sha: commit.sha,
+					force: false
+				},
+				allow: [422]
+			})).status === 422) {
+				if (await this.revision() !== expectedRevision) throw new ConflictError();
+				throw new GitApiError(422, "GitHub couldn't save the changes.");
+			}
+			this.pinned = commit.sha;
+			return { revision: commit.sha };
+		} catch (error) {
+			if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SignInError("cant-publish", "This sign-in can't publish to the site.");
+			throw error;
+		}
+	}
+	async writeGraphQL(changes, { message, expectedRevision }) {
 		const existing = await this.tree(expectedRevision);
 		const additions = changes.flatMap((change) => "delete" in change ? [] : [{
 			path: change.path,
@@ -550,7 +878,8 @@ var GitHubBackend = class {
 		const response = await githubRequest(this.api, `/repos/${this.repo}/actions/runs?head_sha=${revision}&per_page=20`, { allow: [403, 404] });
 		if (!response.ok) return void 0;
 		const { workflow_runs: runs = [] } = await response.json();
-		return runs.find((run) => /deploy|pages/i.test(`${run.path ?? ""} ${run.name ?? ""}`)) ?? runs[0];
+		const builds = runs.filter((run) => !run.path?.endsWith(`/${REBUILD_JOB}.yml`));
+		return builds.find((run) => /deploy|pages/i.test(`${run.path ?? ""} ${run.name ?? ""}`)) ?? builds[0];
 	}
 	/** Which step of a failed run failed. */
 	async runProblem(run) {
@@ -576,13 +905,184 @@ var GitHubBackend = class {
 	}
 };
 //#endregion
+//#region src/sign-in.ts
+/**
+* Talking to the sign-in worker (`@goodfellow-cms/worker`), which signs
+* editors in with GitHub and gives the admin panel a token for the site's
+* repository, lasting an hour. Requests are sent as plain text, so browsers
+* send them straight away without asking the worker first.
+*/
+/** The worker's problems, as the admin panel's sign-in problems. */
+const PROBLEMS = {
+	invalid: "invalid",
+	"no-access": "no-access",
+	"cant-publish": "cant-publish",
+	cancelled: "redirect-failed",
+	"not-installed": "not-installed",
+	"no-address": "no-address",
+	"wrong-address": "wrong-address",
+	"local-address": "local-address",
+	"not-owner": "not-owner"
+};
+/** The worker's answer as a `SignInError`. */
+function signInProblem(answer) {
+	const problem = PROBLEMS[String(answer.problem)] ?? "unavailable";
+	const link = typeof answer.installUrl === "string" && /^https:\/\//.test(answer.installUrl) ? answer.installUrl : void 0;
+	return new SignInError(problem, `The sign-in service said: ${String(answer.problem ?? "no answer")}.`, link);
+}
+/** Addresses on the computer itself, which the worker never gives tokens to. */
+function isLocalAddress(href) {
+	let host;
+	try {
+		host = new URL(href).hostname.toLowerCase();
+	} catch {
+		return true;
+	}
+	return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "[::1]" || /^127(\.\d{1,3}){3}$/.test(host);
+}
+function base64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** A secret that never leaves this tab, and its hash, which the worker checks it against (PKCE's S256). */
+async function newVerifier() {
+	const verifier = base64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: base64Url(new Uint8Array(digest))
+	};
+}
+function browserLocation() {
+	if (typeof window === "undefined") return void 0;
+	return {
+		href: () => window.location.href,
+		assign: (url) => window.location.assign(url),
+		replace: (url) => window.history.replaceState(window.history.state, "", url)
+	};
+}
+/** Query parameters the worker comes back with. */
+const GRANT_PARAM = "goodfellow_sign_in";
+const ERROR_PARAM = "goodfellow_sign_in_error";
+var SignInService = class {
+	url;
+	fetcher;
+	constructor(url, fetcher) {
+		this.url = url.replace(/\/$/, "");
+		this.fetcher = fetcher;
+	}
+	async answer(path, init) {
+		let response;
+		try {
+			response = await this.fetcher(`${this.url}${path}`, init);
+		} catch (error) {
+			throw new SignInError("unavailable", `Couldn't reach the sign-in service: ${error.message}`);
+		}
+		const body = await response.json().catch(() => ({}));
+		if (!response.ok) throw signInProblem(body);
+		return body;
+	}
+	/** Posts JSON as plain text. */
+	post(path, body) {
+		return this.answer(path, {
+			method: "POST",
+			headers: { "content-type": "text/plain" },
+			body: JSON.stringify(body)
+		});
+	}
+	/** Posts JSON as plain text, and gives the answer whatever it is, for callers that explain problems of their own. */
+	async postAnswer(path, body) {
+		let response;
+		try {
+			response = await this.fetcher(`${this.url}${path}`, {
+				method: "POST",
+				headers: { "content-type": "text/plain" },
+				body: JSON.stringify(body)
+			});
+		} catch (error) {
+			throw new SignInError("unavailable", `Couldn't reach the sign-in service: ${error.message}`);
+		}
+		return {
+			ok: response.ok,
+			body: await response.json().catch(() => ({}))
+		};
+	}
+	/** Whether the worker is set up and answering. Throws `SignInError` if it isn't. */
+	async health() {
+		if ((await this.answer("/health")).ok !== true) throw new SignInError("unavailable", "The sign-in service isn't set up.");
+	}
+	/** Whether this page can sign in to the repository through the worker. Throws `SignInError` if it can't. */
+	async check(repo, purpose) {
+		await this.answer(`/github/check?${new URLSearchParams({
+			repo,
+			purpose
+		})}`);
+	}
+	/** Where to send the browser to sign in, or with `install`, to install Goodfellow and sign in. */
+	startUrl(options) {
+		const query = new URLSearchParams({
+			purpose: options.purpose,
+			...options.repo && { repo: options.repo },
+			return: options.back,
+			challenge: options.challenge,
+			remember: options.remember ? "1" : "0",
+			...options.install && { install: "1" }
+		});
+		return `${this.url}/github/start?${query}`;
+	}
+	/**
+	* Exchanges the grant the worker came back with, and this tab's verifier,
+	* for a session (and for a site, its first token, and with `code`, one for
+	* its code repository).
+	*/
+	session(grant, verifier, code) {
+		return this.post("/github/session", {
+			grant,
+			verifier,
+			...code && { code }
+		});
+	}
+	token(session, code) {
+		return this.post("/github/token", {
+			session,
+			...code && { code }
+		});
+	}
+};
+/** A token that renews itself through the worker before it expires, or when GitHub stops accepting it. */
+function renewingToken(service, first, onRenew, code) {
+	let current = first;
+	let renewing;
+	async function token({ refresh = false } = {}) {
+		if (refresh || Date.parse(current.expiresAt) - 3e5 < Date.now()) {
+			renewing ??= service.token(current.session, code).finally(() => {
+				renewing = void 0;
+			});
+			current = await renewing;
+			onRenew(current);
+		}
+		return current.token;
+	}
+	return {
+		current: () => current,
+		token,
+		async codeToken(options) {
+			await token(options);
+			if (!current.code) throw new SignInError("no-access", "The sign-in service gave no token for the code repository.");
+			return current.code.token;
+		}
+	};
+}
+//#endregion
 //#region src/setup.ts
 /** The branch the deploy setups build from. */
 const MAIN = "main";
 /**
 * Links to GitHub's token pages with what creating a site needs: creating the
-* repository (administration), writing its files and its build setup
-* (contents and workflows), and turning on GitHub Pages (pages).
+* repository and adding deploy keys (administration), writing its files and
+* its build setup (contents and workflows), turning on GitHub Pages (pages),
+* and giving a workflow the key to another of the site's repositories (secrets).
 */
 function githubSetupTokenLinks(webUrl = "https://github.com") {
 	const fineGrained = new URLSearchParams({
@@ -592,7 +1092,8 @@ function githubSetupTokenLinks(webUrl = "https://github.com") {
 		administration: "write",
 		contents: "write",
 		workflows: "write",
-		pages: "write"
+		pages: "write",
+		secrets: "write"
 	});
 	const classic = new URLSearchParams({
 		scopes: "repo,workflow",
@@ -603,198 +1104,340 @@ function githubSetupTokenLinks(webUrl = "https://github.com") {
 		classic: `${webUrl}/settings/tokens/new?${classic}`
 	};
 }
-/** Signing in to GitHub to create a site's repository, with GitHub Pages if wanted. */
-function githubSetup(options = {}) {
-	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
-	const links = githubSetupTokenLinks(options.webUrl);
-	const fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);
-	async function connect(token) {
-		const api = {
-			apiUrl,
-			token,
-			fetch: fetcher
-		};
-		const user = await githubJson(api, "/user");
-		async function owners() {
-			return [{
-				path: user.login,
-				name: user.name || user.login,
-				kind: "personal"
-			}, ...(await githubJson(api, "/user/orgs?per_page=100").catch(() => [])).map((org) => ({
-				path: org.login,
-				name: org.login,
-				kind: "organization"
-			}))];
-		}
-		async function isAvailable(owner, name) {
-			return (await githubRequest(api, `/repos/${repoPath(`${owner.path}/${name}`)}`, { allow: [404] })).status === 404;
+/** The steps after the repository exists, which are the same however it was created. */
+function setupAccount(creator) {
+	/** Each repository created, and the token for setting it up, for connecting it to another one later. */
+	const createdApis = /* @__PURE__ */ new Map();
+	/** Makes `main` the default branch, which the deploy setups build from. */
+	async function useMainBranch(api, repo) {
+		if (repo.default_branch === MAIN) return;
+		const base = `/repos/${repoPath(repo.full_name)}`;
+		const ref = await githubJson(api, `${base}/git/ref/heads/${repo.default_branch}`);
+		await githubRequest(api, `${base}/git/refs`, {
+			method: "POST",
+			body: {
+				ref: `refs/heads/${MAIN}`,
+				sha: ref.object.sha
+			}
+		});
+		await githubRequest(api, base, {
+			method: "PATCH",
+			body: { default_branch: MAIN }
+		});
+		await githubRequest(api, `${base}/git/refs/heads/${repo.default_branch}`, { method: "DELETE" });
+	}
+	/** Turns on GitHub Pages, published by the site's own workflow. Returns the site's address. */
+	async function turnOnPages(api, repo) {
+		try {
+			return (await githubJson(api, `/repos/${repoPath(repo.full_name)}/pages`, {
+				method: "POST",
+				body: { build_type: "workflow" }
+			})).html_url;
+		} catch (error) {
+			if (error instanceof GitApiError && [
+				403,
+				404,
+				409,
+				422
+			].includes(error.status)) return void 0;
+			throw error;
 		}
-		async function createRepository(site) {
-			const path = site.owner.kind === "personal" ? "/user/repos" : `/orgs/${encodeURIComponent(site.owner.path)}/repos`;
-			if (!await isAvailable(site.owner, site.name)) throw new SetupError("name-taken", `There's already a repository called ${site.owner.path}/${site.name}.`);
-			try {
-				return await githubJson(api, path, {
-					method: "POST",
-					body: {
-						name: site.name,
-						private: site.private,
-						description: site.description,
-						auto_init: true
-					}
+	}
+	/** Writes every file in one commit, which replaces the starting README rather than following it. */
+	async function writeFiles(api, repo, site) {
+		const base = `/repos/${repoPath(repo.full_name)}`;
+		const tree = [];
+		for (const file of site.files) {
+			if ("delete" in file) continue;
+			if ("content" in file) {
+				tree.push({
+					path: file.path,
+					mode: "100644",
+					type: "blob",
+					content: file.content
 				});
-			} catch (error) {
-				if (error instanceof GitApiError && error.status === 422) throw new SetupError("name-invalid", `GitHub can't use "${site.name}" as a repository name.`);
-				if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SetupError("not-allowed", `This sign-in can't create repositories in ${site.owner.path}.`);
-				throw error;
+				continue;
 			}
+			const blob = await githubJson(api, `${base}/git/blobs`, {
+				method: "POST",
+				body: {
+					content: encodeBase64Bytes(file.bytes),
+					encoding: "base64"
+				}
+			});
+			tree.push({
+				path: file.path,
+				mode: "100644",
+				type: "blob",
+				sha: blob.sha
+			});
 		}
-		/** Makes `main` the default branch, which the deploy setups build from. */
-		async function useMainBranch(repo) {
-			if (repo.default_branch === MAIN) return;
-			const base = `/repos/${repoPath(repo.full_name)}`;
-			const ref = await githubJson(api, `${base}/git/ref/heads/${repo.default_branch}`);
-			await githubRequest(api, `${base}/git/refs`, {
+		try {
+			const created = await githubJson(api, `${base}/git/trees`, {
+				method: "POST",
+				body: { tree }
+			});
+			const commit = await githubJson(api, `${base}/git/commits`, {
 				method: "POST",
 				body: {
-					ref: `refs/heads/${MAIN}`,
-					sha: ref.object.sha
+					message: site.message,
+					tree: created.sha,
+					parents: [],
+					...creator.author && { author: {
+						...creator.author,
+						date: (/* @__PURE__ */ new Date()).toISOString()
+					} }
 				}
 			});
-			await githubRequest(api, base, {
+			await githubRequest(api, `${base}/git/refs/heads/${MAIN}`, {
 				method: "PATCH",
-				body: { default_branch: MAIN }
+				body: {
+					sha: commit.sha,
+					force: true
+				}
 			});
-			await githubRequest(api, `${base}/git/refs/heads/${repo.default_branch}`, { method: "DELETE" });
-		}
-		/** Turns on GitHub Pages, published by the site's own workflow. Returns the site's address. */
-		async function turnOnPages(repo) {
-			try {
-				return (await githubJson(api, `/repos/${repoPath(repo.full_name)}/pages`, {
-					method: "POST",
-					body: { build_type: "workflow" }
-				})).html_url;
-			} catch (error) {
-				if (error instanceof GitApiError && [
-					403,
-					404,
-					409,
-					422
-				].includes(error.status)) return void 0;
-				throw error;
-			}
+		} catch (error) {
+			if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SetupError("not-allowed", "This sign-in can't write the site's files, or its build setup.");
+			throw error;
 		}
-		/** Writes every file in one commit, which replaces the starting README rather than following it. */
-		async function writeFiles(repo, site) {
-			const base = `/repos/${repoPath(repo.full_name)}`;
-			const tree = [];
-			for (const file of site.files) {
-				if ("delete" in file) continue;
-				if ("content" in file) {
-					tree.push({
-						path: file.path,
-						mode: "100644",
-						type: "blob",
-						content: file.content
-					});
-					continue;
-				}
-				const blob = await githubJson(api, `${base}/git/blobs`, {
-					method: "POST",
-					body: {
-						content: encodeBase64Bytes(file.bytes),
-						encoding: "base64"
-					}
-				});
-				tree.push({
-					path: file.path,
-					mode: "100644",
-					type: "blob",
-					sha: blob.sha
-				});
-			}
-			try {
-				const created = await githubJson(api, `${base}/git/trees`, {
-					method: "POST",
-					body: { tree }
-				});
-				const commit = await githubJson(api, `${base}/git/commits`, {
+	}
+	/** Stops anyone rewriting or deleting the main branch's history. Not every plan allows it. */
+	async function protectMain(api, repo) {
+		return (await githubRequest(api, `/repos/${repoPath(repo.full_name)}/rulesets`, {
+			method: "POST",
+			body: {
+				name: "Protect the published history",
+				target: "branch",
+				enforcement: "active",
+				conditions: { ref_name: {
+					include: ["~DEFAULT_BRANCH"],
+					exclude: []
+				} },
+				rules: [{ type: "non_fast_forward" }, { type: "deletion" }]
+			},
+			allow: [
+				403,
+				404,
+				422
+			]
+		})).ok;
+	}
+	/**
+	* Lets each private repository's workflows read the other, as their setup
+	* files say: a read-only deploy key on the one read, with its private half
+	* a secret of the one reading. Public repositories need nothing. Returns
+	* whether it worked: an older sign-in may not be allowed to set secrets.
+	*/
+	async function connectRepositories(link) {
+		if (!link.private) return true;
+		const { newDeployKey, sealSecret } = await import("./deploy-keys-DAj2oX-N.js").then((n) => n.t);
+		try {
+			for (const { reader, read, secret } of link.links.reads) {
+				if (!secret) continue;
+				const readerRepo = link[reader];
+				const readRepo = link[read];
+				const readerApi = createdApis.get(readerRepo.toLowerCase());
+				const readApi = createdApis.get(readRepo.toLowerCase());
+				if (!readerApi || !readApi) throw new Error(`${readerRepo} and ${readRepo} have to be created first.`);
+				const key = await newDeployKey(`goodfellow-${secret.toLowerCase()}`);
+				await githubRequest(readApi, `/repos/${repoPath(readRepo)}/keys`, {
 					method: "POST",
 					body: {
-						message: site.message,
-						tree: created.sha,
-						parents: []
+						title: `${readerRepo}'s builds`,
+						key: key.publicKey,
+						read_only: true
 					}
 				});
-				await githubRequest(api, `${base}/git/refs/heads/${MAIN}`, {
-					method: "PATCH",
+				const base = `/repos/${repoPath(readerRepo)}/actions/secrets`;
+				const publicKey = await githubJson(readerApi, `${base}/public-key`);
+				const sealed = await sealSecret(key.privateKey, decodeBase64(publicKey.key));
+				await githubRequest(readerApi, `${base}/${secret}`, {
+					method: "PUT",
 					body: {
-						sha: commit.sha,
-						force: true
+						encrypted_value: encodeBase64Bytes(sealed),
+						key_id: publicKey.key_id
 					}
 				});
-			} catch (error) {
-				if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SetupError("not-allowed", "This sign-in can't write the site's files, or its build setup.");
-				throw error;
 			}
+			return true;
+		} catch (error) {
+			if (error instanceof GitApiError && [
+				403,
+				404,
+				422
+			].includes(error.status)) return false;
+			throw error;
 		}
-		/** Stops anyone rewriting or deleting the main branch's history. Not every plan allows it. */
-		async function protectMain(repo) {
-			return (await githubRequest(api, `/repos/${repoPath(repo.full_name)}/rulesets`, {
-				method: "POST",
-				body: {
-					name: "Protect the published history",
-					target: "branch",
-					enforcement: "active",
-					conditions: { ref_name: {
-						include: ["~DEFAULT_BRANCH"],
-						exclude: []
-					} },
-					rules: [{ type: "non_fast_forward" }, { type: "deletion" }]
-				},
-				allow: [
-					403,
-					404,
-					422
-				]
-			})).ok;
+	}
+	return {
+		user: creator.user,
+		owners: () => creator.owners(),
+		isAvailable: (owner, name) => creator.isAvailable(owner, name),
+		async createSite(site, onStep) {
+			const warnings = [];
+			onStep?.("repository");
+			const { repo, api, signInInstallUrl } = await creator.create(site);
+			const connect = async (link) => {
+				onStep?.("connect");
+				return connectRepositories(link);
+			};
+			await useMainBranch(api, repo);
+			let siteUrl;
+			if (site.pages) {
+				onStep?.("pages");
+				siteUrl = await turnOnPages(api, repo);
+				if (!siteUrl) warnings.push("pages-unavailable");
+			}
+			createdApis.set(repo.full_name.toLowerCase(), api);
+			if (site.link && !await connect(site.link)) warnings.push("connect-unavailable");
+			onStep?.("files");
+			await writeFiles(api, repo, site);
+			onStep?.("protection");
+			if (!await protectMain(api, repo)) warnings.push("protection-unavailable");
+			if (signInInstallUrl) warnings.push("sign-in-not-installed");
+			return {
+				repo: repo.full_name,
+				webUrl: repo.html_url,
+				siteUrl,
+				buildsUrl: `${repo.html_url}/actions`,
+				pagesUrl: site.pages ? `${repo.html_url}/settings/pages` : void 0,
+				...signInInstallUrl && { signInInstallUrl },
+				warnings
+			};
 		}
-		return {
-			user: {
-				login: user.login,
-				name: user.name ?? void 0,
-				avatarUrl: user.avatar_url
-			},
-			owners,
-			isAvailable,
-			async createSite(site, onStep) {
-				const warnings = [];
-				onStep?.("repository");
-				const repo = await createRepository(site);
-				await useMainBranch(repo);
-				let siteUrl;
-				if (site.pages) {
-					onStep?.("pages");
-					siteUrl = await turnOnPages(repo);
-					if (!siteUrl) warnings.push("pages-unavailable");
-				}
-				onStep?.("files");
-				await writeFiles(repo, site);
-				onStep?.("protection");
-				if (!await protectMain(repo)) warnings.push("protection-unavailable");
+	};
+}
+/** Creating repositories with the person's own token. */
+async function tokenCreator(api) {
+	const user = await githubJson(api, "/user");
+	async function isAvailable(owner, name) {
+		return (await githubRequest(api, `/repos/${repoPath(`${owner.path}/${name}`)}`, { allow: [404] })).status === 404;
+	}
+	return {
+		user: {
+			login: user.login,
+			name: user.name ?? void 0,
+			avatarUrl: user.avatar_url
+		},
+		async owners() {
+			return [{
+				path: user.login,
+				name: user.name || user.login,
+				kind: "personal"
+			}, ...(await githubJson(api, "/user/orgs?per_page=100").catch(() => [])).map((org) => ({
+				path: org.login,
+				name: org.login,
+				kind: "organization"
+			}))];
+		},
+		isAvailable,
+		async create(site) {
+			const path = site.owner.kind === "personal" ? "/user/repos" : `/orgs/${encodeURIComponent(site.owner.path)}/repos`;
+			if (!await isAvailable(site.owner, site.name)) throw new SetupError("name-taken", `There's already a repository called ${site.owner.path}/${site.name}.`);
+			try {
 				return {
-					repo: repo.full_name,
-					webUrl: repo.html_url,
-					siteUrl,
-					buildsUrl: `${repo.html_url}/actions`,
-					pagesUrl: site.pages ? `${repo.html_url}/settings/pages` : void 0,
-					warnings
+					repo: await githubJson(api, path, {
+						method: "POST",
+						body: {
+							name: site.name,
+							private: site.private,
+							description: site.description,
+							auto_init: true
+						}
+					}),
+					api
 				};
+			} catch (error) {
+				if (error instanceof GitApiError && error.status === 422) throw new SetupError("name-invalid", `GitHub can't use "${site.name}" as a repository name.`);
+				if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SetupError("not-allowed", `This sign-in can't create repositories in ${site.owner.path}.`);
+				throw error;
 			}
-		};
+		}
+	};
+}
+/**
+* Creating repositories through the sign-in worker, which uses the person's
+* GitHub token itself and gives back a token for the new repository only.
+*/
+function workerCreator(service, apiUrl, fetcher, signedIn) {
+	let session = signedIn.session;
+	async function call(path, body) {
+		const answer = await service.postAnswer(path, {
+			session,
+			...body
+		});
+		if (typeof answer.body.session === "string") session = answer.body.session;
+		if (!answer.ok) throw setupProblem(answer.body);
+		return answer.body;
+	}
+	const { user } = signedIn;
+	return {
+		user: {
+			login: user.login,
+			name: user.name,
+			avatarUrl: user.avatarUrl
+		},
+		author: {
+			name: user.name || user.login,
+			email: user.email
+		},
+		async owners() {
+			const found = await call("/github/setup/owners", {});
+			return (found.owners ?? []).map(({ installed, ...owner }) => ({
+				...owner,
+				...!installed && found.installUrl && { installUrl: found.installUrl }
+			}));
+		},
+		async isAvailable(owner, name) {
+			return (await call("/github/setup/available", {
+				owner: owner.path,
+				name
+			})).available === true;
+		},
+		async create(site) {
+			if (site.owner.installUrl) throw new SetupError("not-installed", `Goodfellow isn't installed on ${site.owner.path}.`, site.owner.installUrl);
+			const created = await call("/github/setup/repository", {
+				owner: site.owner.path,
+				name: site.name,
+				private: site.private,
+				description: site.description,
+				...site.more && { more: true }
+			});
+			if (!created.repo || !created.token) throw new SignInError("unavailable", "The sign-in service didn't answer.");
+			return {
+				repo: created.repo,
+				api: {
+					apiUrl,
+					token: created.token,
+					fetch: fetcher
+				},
+				...created.editInstallUrl && { signInInstallUrl: created.editInstallUrl }
+			};
+		}
+	};
+}
+/** The worker's answer when it couldn't create the repository, as a `SetupError` or `SignInError`. */
+function setupProblem(answer) {
+	switch (answer.problem) {
+		case "name-taken": return new SetupError("name-taken", "There's already a repository with that name.");
+		case "name-invalid": return new SetupError("name-invalid", "GitHub can't use that as a repository name.");
+		case "not-allowed": return new SetupError("not-allowed", "This sign-in can't create repositories there.");
+		case "not-installed": return new SetupError("not-installed", "Goodfellow isn't installed there.", answer.installUrl);
+		default: return signInProblem(answer);
 	}
+}
+/** Signing in to GitHub to create a site's repository, with GitHub Pages if wanted. */
+function githubSetup(options = {}) {
+	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const links = githubSetupTokenLinks(options.webUrl);
+	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	const location = options.location ?? browserLocation();
+	const signInUrl = options.signIn;
+	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
+	const pending = credentialStorage("goodfellow:github:setup:pending", options.storage);
 	return {
 		name: "GitHub",
-		canRedirect: false,
+		canRedirect: service !== void 0,
 		tokenLinks: [{
 			url: links.fineGrained,
 			label: "signIn.token.create"
@@ -804,20 +1447,50 @@ function githubSetup(options = {}) {
 			hint: "signIn.token.createBroadHint"
 		}],
 		async restore() {
-			return null;
+			if (!location) return null;
+			const url = new URL(location.href());
+			const grant = url.searchParams.get(GRANT_PARAM);
+			const failed = url.searchParams.get(ERROR_PARAM);
+			if (!grant && !failed) return null;
+			url.searchParams.delete(GRANT_PARAM);
+			url.searchParams.delete(ERROR_PARAM);
+			location.replace(url.toString());
+			const verifier = pending.load();
+			pending.clear();
+			if (failed || !grant || !verifier || !service) throw signInProblem({ problem: failed ?? "cancelled" });
+			const signedIn = await service.session(grant, verifier);
+			return setupAccount(workerCreator(service, apiUrl, fetcher, signedIn));
 		},
 		async signInWithToken(token) {
 			const trimmed = token.trim();
 			if (!trimmed) throw new SignInError("invalid", "Paste a token to sign in.");
-			return connect(trimmed);
+			return setupAccount(await tokenCreator({
+				apiUrl,
+				token: trimmed,
+				fetch: fetcher
+			}));
 		},
-		async startRedirect() {
-			throw new Error("Signing in by redirect needs a sign-in server, which isn't supported for GitHub yet.");
+		async startRedirect({ install } = {}) {
+			if (!service || !location) throw new SignInError("unavailable", "Signing in with GitHub isn't available here.");
+			await service.health();
+			const { verifier, challenge } = await newVerifier();
+			pending.save(verifier, false);
+			location.assign(service.startUrl({
+				purpose: "setup",
+				back: location.href(),
+				challenge,
+				remember: false,
+				install
+			}));
 		}
 	};
 }
 //#endregion
 //#region src/index.ts
+/** Saved sign-ins to forget when they stop working: not when the worker can't be reached, which passes. */
+function forgets(error) {
+	return error instanceof SignInError && error.problem !== "unavailable";
+}
 /**
 * Links to GitHub's token page with everything filled in except the
 * repository, which GitHub doesn't let links choose.
@@ -855,14 +1528,175 @@ function githubTokenLinks(repo, webUrl = "https://github.com") {
 /** Sign-in and storage for a site whose repository is on GitHub. */
 function github(options) {
 	if (!/^[\w.-]+\/[\w.-]+$/.test(options.repo)) throw new Error(`github({ repo }) must look like "owner/name" (got "${options.repo}").`);
+	if (options.code !== void 0 && !/^[\w.-]+\/[\w.-]+$/.test(options.code)) throw new Error(`github({ code }) must look like "owner/name" (got "${options.code}").`);
 	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const webUrl = (options.webUrl ?? "https://github.com").replace(/\/$/, "");
+	/** The code repository, where the content is in a repository of its own, read with `api`. */
+	const codeRepository = (api) => options.contentOnly && options.code ? { code: {
+		repo: options.code,
+		webUrl,
+		...api && { api }
+	} } : {};
 	const links = githubTokenLinks(options.repo, options.webUrl);
 	const storage = credentialStorage(`goodfellow:github:${options.repo}`, options.storage);
+	const pending = credentialStorage(`goodfellow:github:pending:${options.repo}`, options.storage);
+	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	const location = options.location ?? browserLocation();
+	const signInUrl = options.signIn;
+	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
+	/** The code repository to ask the worker for a token for, where the Updates screen follows it. */
+	const codeName = () => options.contentOnly ? options.code : void 0;
+	function save(value, remember) {
+		storage.save(value.type === "token" ? value.token : JSON.stringify(value), remember);
+	}
+	function loadSaved() {
+		const value = storage.load();
+		if (!value) return void 0;
+		try {
+			const parsed = JSON.parse(value);
+			if (parsed.type === "worker" || parsed.type === "token") return parsed;
+		} catch {}
+		return {
+			type: "token",
+			token: value
+		};
+	}
+	/**
+	* Sends the browser to GitHub through the worker, which comes back to this
+	* screen. With `install`, GitHub's install page installs Goodfellow first.
+	*/
+	async function redirect(purpose, remember, { install } = {}) {
+		if (!service || !location) throw new SignInError("unavailable", "Signing in with GitHub isn't available here.");
+		if (!install) await service.check(options.repo, purpose);
+		const { verifier, challenge } = await newVerifier();
+		pending.save(JSON.stringify({
+			verifier,
+			purpose,
+			remember
+		}), false);
+		location.assign(service.startUrl({
+			purpose,
+			repo: options.repo,
+			back: location.href(),
+			challenge,
+			remember,
+			install
+		}));
+	}
+	/** Connects with a session from the worker, whose tokens renew themselves. */
+	async function connectWorker(issued, remember) {
+		const source = renewingToken(service, issued, (renewed) => save({
+			type: "worker",
+			session: renewed.session
+		}, remember), options.code);
+		save({
+			type: "worker",
+			session: issued.session
+		}, remember);
+		const api = {
+			apiUrl,
+			token: source.token,
+			fetch: fetcher
+		};
+		const repo = await githubJson(api, `/repos/${repoPath(options.repo)}`);
+		const { user } = issued;
+		return new GitHubBackend({
+			api,
+			repo: options.repo,
+			branch: options.branch ?? repo.default_branch,
+			...options.contentOnly && { contentOnly: true },
+			...codeRepository({
+				apiUrl,
+				token: source.codeToken,
+				fetch: fetcher
+			}),
+			user: {
+				login: user.login,
+				name: user.name,
+				avatarUrl: user.avatarUrl
+			},
+			author: {
+				name: user.name || user.login,
+				email: user.email
+			},
+			onSignOut: () => {
+				storage.clear();
+				revokeIssued(source.current());
+			},
+			ownerTokenLink: {
+				url: links.owner,
+				label: "owner.token.create"
+			},
+			ownerRedirect: (redirectOptions) => redirect("owner", false, redirectOptions)
+		});
+	}
+	/** Revokes a token the worker gave, as signing out does. Never fails: signing out goes ahead regardless. */
+	function revokeToken(token) {
+		githubRequest({
+			apiUrl,
+			token,
+			fetch: fetcher
+		}, "/installation/token", { method: "DELETE" }).catch(() => {});
+	}
+	/** Revokes the tokens the worker gave: the site's, and the code repository's. */
+	function revokeIssued(issued) {
+		revokeToken(issued.token);
+		if (issued.code) revokeToken(issued.code.token);
+	}
+	/** Gives the backend an owner's sign-in that has just come back from GitHub. It's kept in memory only. */
+	async function useOwner(backend, grant, verifier) {
+		const worker = service;
+		try {
+			const source = renewingToken(worker, await worker.session(grant, verifier, codeName()), () => {}, codeName());
+			backend.useOwnerSignIn(source.token, () => revokeIssued(source.current()), codeName() ? source.codeToken : void 0);
+		} catch (error) {
+			backend.ownerSignInFailed(error);
+		}
+	}
+	/** Finishes a sign-in through the worker if the page has just come back from it. */
+	async function completeRedirect() {
+		if (!location) return void 0;
+		const url = new URL(location.href());
+		const grant = url.searchParams.get(GRANT_PARAM);
+		const failed = url.searchParams.get(ERROR_PARAM);
+		if (!grant && !failed) return void 0;
+		url.searchParams.delete(GRANT_PARAM);
+		url.searchParams.delete(ERROR_PARAM);
+		location.replace(url.toString());
+		const saved = pending.load();
+		pending.clear();
+		const redirect = saved ? JSON.parse(saved) : void 0;
+		if (!redirect || !service) throw new SignInError("redirect-failed", "Signing in with GitHub didn't finish in this tab.");
+		if (redirect.purpose === "owner") {
+			const backend = await restoreSaved();
+			if (!backend) throw new SignInError("redirect-failed", "Sign in again, then sign in as an owner.");
+			if (failed) backend.ownerSignInFailed(signInProblem({ problem: failed }));
+			else if (grant) await useOwner(backend, grant, redirect.verifier);
+			return backend;
+		}
+		if (failed || !grant) throw signInProblem({ problem: failed });
+		return connectWorker(await service.session(grant, redirect.verifier, codeName()), redirect.remember);
+	}
+	async function restoreSaved() {
+		const saved = loadSaved();
+		if (!saved) return null;
+		try {
+			if (saved.type === "token") return await connect(saved.token);
+			if (!service) {
+				storage.clear();
+				return null;
+			}
+			return await connectWorker(await service.token(saved.session, codeName()), storage.remembered());
+		} catch (error) {
+			if (forgets(error)) storage.clear();
+			throw error;
+		}
+	}
 	async function connect(token) {
 		const api = {
 			apiUrl,
 			token,
-			fetch: options.fetch ?? globalThis.fetch.bind(globalThis)
+			fetch: fetcher
 		};
 		const user = await githubJson(api, "/user");
 		let repo;
@@ -877,6 +1711,8 @@ function github(options) {
 			api,
 			repo: options.repo,
 			branch: options.branch ?? repo.default_branch,
+			...options.contentOnly && { contentOnly: true },
+			...codeRepository(api),
 			user: {
 				login: user.login,
 				name: user.name ?? void 0,
@@ -886,12 +1722,53 @@ function github(options) {
 			ownerTokenLink: {
 				url: links.owner,
 				label: "owner.token.create"
-			}
+			},
+			...service && { ownerRedirect: (redirectOptions) => redirect("owner", false, redirectOptions) }
+		});
+	}
+	/** The repository through a token of the site's own, on a full-stack site's server. */
+	function server({ token }) {
+		const api = {
+			apiUrl,
+			token: typeof token === "string" ? token : () => token(),
+			fetch: fetcher
+		};
+		let branch;
+		const liveBranch = () => {
+			branch ??= options.branch ? Promise.resolve(options.branch) : githubJson(api, `/repos/${repoPath(options.repo)}`).then((repo) => repo.default_branch);
+			branch.catch(() => {
+				branch = void 0;
+			});
+			return branch;
+		};
+		const backend = async (revision, author) => new GitHubBackend({
+			api,
+			repo: options.repo,
+			branch: await liveBranch(),
+			...options.contentOnly && { contentOnly: true },
+			user: {
+				login: author?.name ?? options.repo,
+				...author && { name: author.name }
+			},
+			onSignOut: () => {},
+			ownerTokenLink: {
+				url: links.owner,
+				label: "owner.token.create"
+			},
+			...revision && { revision },
+			...author && { author }
 		});
+		return {
+			...options.contentOnly && { contentOnly: true },
+			async revision() {
+				return (await backend()).revision();
+			},
+			at: backend
+		};
 	}
 	return {
 		name: "GitHub",
-		canRedirect: false,
+		canRedirect: service !== void 0,
 		tokenLinks: [{
 			url: links.fineGrained,
 			label: "signIn.token.create"
@@ -901,25 +1778,24 @@ function github(options) {
 			hint: "signIn.token.createBroadHint"
 		}],
 		async restore() {
-			const token = storage.load();
-			if (!token) return null;
-			try {
-				return await connect(token);
-			} catch (error) {
-				if (error instanceof SignInError) storage.clear();
-				throw error;
-			}
+			const redirected = await completeRedirect();
+			if (redirected !== void 0) return redirected;
+			return restoreSaved();
 		},
 		async signInWithToken(token, remember) {
 			const trimmed = token.trim();
 			if (!trimmed) throw new SignInError("invalid", "Paste a token to sign in.");
 			const backend = await connect(trimmed);
-			storage.save(trimmed, remember);
+			save({
+				type: "token",
+				token: trimmed
+			}, remember);
 			return backend;
 		},
-		async startRedirect() {
-			throw new Error("Signing in by redirect needs a sign-in server, which isn't supported for GitHub yet.");
-		}
+		startRedirect(remember, redirectOptions) {
+			return redirect("edit", remember, redirectOptions);
+		},
+		server
 	};
 }
 //#endregion