@goodfellow-cms/github 0.3.0 → 0.4.0

package/dist/deploy-keys-DAj2oX-N.js

@@ -0,0 +1,108 @@
+import { encodeBase64Bytes } from "@goodfellow-cms/core";
+import { hsalsa, xsalsa20poly1305 } from "@noble/ciphers/salsa.js";
+import { blake2b } from "@noble/hashes/blake2.js";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/deploy-keys.ts
+/**
+* Deploy keys and Actions secrets, for connecting a site's private code and
+* content repositories: each workflow reads the other repository with a
+* deploy key, whose private half is a secret of the repository it runs in.
+* Loaded only by the setup page, when it connects them.
+*/
+var deploy_keys_exports = /* @__PURE__ */ __exportAll({
+	newDeployKey: () => newDeployKey,
+	openSealedSecret: () => openSealedSecret,
+	sealSecret: () => sealSecret
+});
+function concat(...parts) {
+	const result = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+	let at = 0;
+	for (const part of parts) {
+		result.set(part, at);
+		at += part.length;
+	}
+	return result;
+}
+/** SSH's encoding of a number: four bytes, most significant first. */
+function uint32(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(4);
+	new DataView(bytes.buffer).setUint32(0, value);
+	return bytes;
+}
+/** SSH's encoding of a string of bytes: its length, then the bytes. */
+function sshString(value) {
+	const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+	return concat(uint32(bytes.length), bytes);
+}
+/** A new Ed25519 key pair, made with the browser's own Web Crypto, as `ssh-keygen -t ed25519 -N ""` would make it. */
+async function newDeployKey(comment) {
+	const pair = await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
+	const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const seed = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey)).slice(-32);
+	const publicBlob = concat(sshString("ssh-ed25519"), sshString(publicKey));
+	const check = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4));
+	let secret = concat(check, check, sshString("ssh-ed25519"), sshString(publicKey), sshString(concat(seed, publicKey)), sshString(comment));
+	const padding = Array.from({ length: (8 - secret.length % 8) % 8 }, (_, index) => index + 1);
+	secret = concat(secret, new Uint8Array(padding));
+	const body = concat(new TextEncoder().encode("openssh-key-v1\0"), sshString("none"), sshString("none"), sshString(""), uint32(1), sshString(publicBlob), sshString(secret));
+	const lines = encodeBase64Bytes(body).match(/.{1,70}/g) ?? [];
+	seed.fill(0);
+	secret.fill(0);
+	return {
+		publicKey: `ssh-ed25519 ${encodeBase64Bytes(publicBlob)} ${comment}`,
+		privateKey: `-----BEGIN OPENSSH PRIVATE KEY-----\n${lines.join("\n")}\n-----END OPENSSH PRIVATE KEY-----\n`
+	};
+}
+const SIGMA = new TextEncoder().encode("expand 32-byte k");
+function words(bytes) {
+	return new Uint32Array(bytes.slice().buffer);
+}
+/**
+* Encrypts a value for an Actions secret, as libsodium's `crypto_box_seal`
+* does, which is what GitHub expects: an X25519 key of its own, the Web
+* Crypto key agreement with the repository's public key, and XSalsa20-Poly1305.
+*/
+async function sealSecret(value, recipient) {
+	const ephemeral = await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]);
+	const ephemeralPublic = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	const recipientKey = await crypto.subtle.importKey("raw", recipient.slice(), { name: "X25519" }, false, []);
+	const shared = new Uint8Array(await crypto.subtle.deriveBits({
+		name: "X25519",
+		public: recipientKey
+	}, ephemeral.privateKey, 256));
+	const key = /* @__PURE__ */ new Uint32Array(8);
+	hsalsa(words(SIGMA), words(shared), /* @__PURE__ */ new Uint32Array(4), key);
+	const nonce = blake2b(concat(ephemeralPublic, recipient), { dkLen: 24 });
+	const keyBytes = new Uint8Array(key.buffer);
+	const sealed = xsalsa20poly1305(keyBytes, nonce).encrypt(new TextEncoder().encode(value));
+	shared.fill(0);
+	keyBytes.fill(0);
+	return concat(ephemeralPublic, sealed);
+}
+/** Opens a sealed value with the recipient's X25519 key pair, as GitHub does with a secret. For the fake. */
+async function openSealedSecret(sealed, recipient) {
+	const ephemeralPublic = sealed.slice(0, 32);
+	const recipientPublic = new Uint8Array(await crypto.subtle.exportKey("raw", recipient.publicKey));
+	const ephemeralKey = await crypto.subtle.importKey("raw", ephemeralPublic, { name: "X25519" }, false, []);
+	const shared = new Uint8Array(await crypto.subtle.deriveBits({
+		name: "X25519",
+		public: ephemeralKey
+	}, recipient.privateKey, 256));
+	const key = /* @__PURE__ */ new Uint32Array(8);
+	hsalsa(words(SIGMA), words(shared), /* @__PURE__ */ new Uint32Array(4), key);
+	const nonce = blake2b(concat(ephemeralPublic, recipientPublic), { dkLen: 24 });
+	return new TextDecoder().decode(xsalsa20poly1305(new Uint8Array(key.buffer), nonce).decrypt(sealed.slice(32)));
+}
+//#endregion
+export { openSealedSecret as n, deploy_keys_exports as t };

package/dist/index.d.ts

@@ -1,7 +1,5 @@
 import { ConnectDomainOptions, DeployStatus, DnsRecord, FileChange, FileVersion, GitBackend, GitHost, GitUser, HistoryOptions, OwnerAccess, PagesDomains, RedirectOptions, SetupHost, SignInError, SiteDrafts, SiteEditors, SiteUpdates, StorageLike, TokenLink, WriteOptions } from "@goodfellow-cms/core";
 //#region src/sign-in.d.ts
-/** The sign-in worker Goodfellow runs for every site. Sites can run their own and name it in `github({ signIn })`. */
-export declare const GOODFELLOW_SIGN_IN = "https://sign-in.goodfellow-cms.workers.dev";
 /** The page's address and how to change it. Replaceable in tests. */
 interface BrowserLocation {
   href(): string;
@@ -42,6 +40,19 @@ interface GitHubBackendOptions {
     name: string;
     email: string;
   };
+  /** The commit reads see until `revision()` is next called, as a full-stack site's server reads what a browser loaded. */
+  revision?: string;
+  /** The repository holds only the site's content, with its code in a repository of its own (`GitBackend.contentOnly`). */
+  contentOnly?: boolean;
+  /**
+   * The code repository, for a repository that holds only content, where the
+   * site's updates run: `api` reads it, absent where the sign-in can't.
+   */
+  code?: {
+    repo: string;
+    webUrl: string;
+    api?: ApiOptions;
+  };
 }
 /**
  * The site's files on GitHub. Reads come from the commit `revision()` last
@@ -53,8 +64,10 @@ export declare class GitHubBackend implements GitBackend {
   readonly pages: PagesDomains;
   readonly editors: SiteEditors;
   readonly ownerAccess: OwnerAccess;
-  readonly updates: SiteUpdates;
+  /** Absent where the repository holds only content: the update job runs where the code is. */
+  readonly updates?: SiteUpdates;
   readonly drafts: SiteDrafts;
+  readonly contentOnly: boolean;
   private readonly options;
   private readonly api;
   private readonly repo;
@@ -82,7 +95,7 @@ export declare class GitHubBackend implements GitBackend {
   list(dir: string): Promise<string[]>;
   fileSizes(dir: string): Promise<Map<string, number>>;
   /** Uses an owner's sign-in through the worker for editors and GitHub Pages settings, until it's forgotten. */
-  useOwnerSignIn(token: TokenSource, end: () => void): void;
+  useOwnerSignIn(token: TokenSource, end: () => void, codeToken?: TokenSource): void;
   /** Remembers why an owner's sign-in through the worker didn't work, which the Editors and Domain screens show. */
   ownerSignInFailed(error: unknown): void;
   write(changes: FileChange[], options: WriteOptions): Promise<{
@@ -122,7 +135,7 @@ interface GitHubSetupOptions {
   apiUrl?: string;
   /** For GitHub Enterprise. Defaults to `https://github.com`. */
   webUrl?: string;
-  /** The sign-in worker, for "Sign in with GitHub". Defaults to Goodfellow's; `false` for token sign-in only. */
+  /** The address of a sign-in worker, for "Sign in with GitHub". Without one, people sign in with a token. */
   signIn?: string | false;
   /** For tests. */
   fetch?: typeof fetch;
@@ -136,8 +149,9 @@ interface GitHubSetupOptions {
 }
 /**
  * Links to GitHub's token pages with what creating a site needs: creating the
- * repository (administration), writing its files and its build setup
- * (contents and workflows), and turning on GitHub Pages (pages).
+ * repository and adding deploy keys (administration), writing its files and
+ * its build setup (contents and workflows), turning on GitHub Pages (pages),
+ * and giving a workflow the key to another of the site's repositories (secrets).
  */
 export declare function githubSetupTokenLinks(webUrl?: string): {
   fineGrained: string;
@@ -157,11 +171,22 @@ export interface GitHubOptions {
   /** For GitHub Enterprise. Defaults to `https://github.com`. */
   webUrl?: string;
   /**
-   * The sign-in worker, which lets editors sign in with GitHub instead of
-   * pasting a token. Defaults to Goodfellow's (`GOODFELLOW_SIGN_IN`); give the
-   * address of your own copy, or `false` for token sign-in only.
+   * The address of a sign-in worker, which lets editors sign in with GitHub
+   * instead of pasting a token. Without one, editors sign in with a token.
    */
   signIn?: string | false;
+  /**
+   * The repository holds only the site's content (`content/` and
+   * `public/media/`), and its code is in a repository of its own. The admin
+   * panel then leaves adding blocks, which changes code, to a developer.
+   */
+  contentOnly?: boolean;
+  /**
+   * With `contentOnly`, the repository the site's code is kept in, as
+   * `owner/name`, where its updates run: the Updates screen follows them.
+   * Editors' tokens need to reach it too: a sign-in worker's app installed on it, or tokens made for both.
+   */
+  code?: string;
   /** For tests. */
   fetch?: typeof fetch;
   /** For tests. */

package/dist/index.js

@@ -1,4 +1,4 @@
-import { ConflictError, DomainError, DraftError, EditorsError, GitApiError, SetupError, SignInError, UpdatesError, branchDrafts, buildStepFor, compareReleases, credentialStorage, encodeBase64, encodeBase64Bytes, siteVersion } from "@goodfellow-cms/core";
+import { ConflictError, DomainError, DraftError, EditorsError, GitApiError, REBUILD_JOB, SetupError, SignInError, UpdatesError, assertContentChanges, branchDrafts, buildStepFor, compareReleases, credentialStorage, decodeBase64, encodeBase64, encodeBase64Bytes, siteVersion } from "@goodfellow-cms/core";
 //#region src/api.ts
 /** Calls the GitHub REST or GraphQL API. Treats 401 as an expired sign-in; other errors become `GitApiError`. */
 async function githubRequest({ apiUrl, token, fetch }, path, init = {}) {
@@ -148,6 +148,8 @@ function githubEditors(read, manage, repo, login) {
 */
 function githubOwnerAccess(base, repo, tokenLink, redirect) {
 	let owner;
+	/** The owner's access to the site's code repository, where its content is kept in a repository of its own. */
+	let ownerCode;
 	let endSignIn;
 	let problem;
 	return {
@@ -177,21 +179,28 @@ function githubOwnerAccess(base, repo, tokenLink, redirect) {
 					throw error;
 				}
 				owner = api;
+				ownerCode = api;
 				problem = void 0;
 			},
 			forget() {
 				owner = void 0;
+				ownerCode = void 0;
 				endSignIn?.();
 				endSignIn = void 0;
 			}
 		},
 		api: () => owner,
-		/** Uses an owner's sign-in through the worker. `end` runs when it's forgotten. */
-		useSignIn(token, end) {
+		codeApi: () => ownerCode,
+		/** Uses an owner's sign-in through the worker, with its token for the code repository if it gave one. `end` runs when it's forgotten. */
+		useSignIn(token, end, codeToken) {
 			owner = {
 				...base,
 				token
 			};
+			ownerCode = codeToken ? {
+				...base,
+				token: codeToken
+			} : void 0;
 			endSignIn = end;
 			problem = void 0;
 		},
@@ -322,17 +331,19 @@ function githubPages(api, repo) {
 //#region src/updates.ts
 /** The starters' GitHub Pages workflow, which runs `goodfellow update` each night and when it's dispatched. */
 const WORKFLOW = "deploy.yml";
-const WORKFLOW_FILE = `.github/workflows/${WORKFLOW}`;
+/** The code repository's workflow, where a site keeps its content in a repository of its own. */
+const CODE_WORKFLOW = "update.yml";
 /**
 * The site's nightly update, which runs in its GitHub Pages workflow. Running
 * it now dispatches the workflow, which needs GitHub's Actions permission
 * with write access: `manage()` gives the owner token when one is in use.
 */
-function githubUpdates(read, manage, repo, branch, files) {
-	const path = `/repos/${repo}/actions/workflows/${WORKFLOW}`;
+function githubUpdates(read, manage, repo, branch, files, workflow = WORKFLOW) {
+	const path = `/repos/${repo}/actions/workflows/${workflow}`;
+	const workflowFile = `.github/workflows/${workflow}`;
 	return {
 		async setup() {
-			return (await files.read(WORKFLOW_FILE))?.includes("update --publish") ? "ready" : "missing";
+			return (await files.read(workflowFile))?.includes("update --publish") ? "ready" : "missing";
 		},
 		async lastRun() {
 			const response = await githubRequest(read, `${path}/runs?branch=${encodeURIComponent(branch)}&per_page=20`, { allow: [403, 404] });
@@ -390,6 +401,73 @@ function githubUpdates(read, manage, repo, branch, files) {
 		}
 	};
 }
+/** Whether an error means the sign-in can't see the code repository, or has no token for it. */
+function noAccess(error) {
+	return error instanceof SignInError && error.problem === "no-access" || error instanceof GitApiError && (error.status === 403 || error.status === 404);
+}
+/**
+* The nightly update of a site whose content is kept in a repository of its
+* own, which runs in the code repository's `update.yml`. The sign-in needs to
+* see the code repository too; where it can't, `setup()` says `no-access`.
+*/
+function githubCodeUpdates(options) {
+	const { read } = options;
+	const repo = repoPath(options.repo);
+	let branch;
+	const liveBranch = (api) => {
+		branch ??= githubJson(api, `/repos/${repo}`).then((found) => found.default_branch);
+		branch.catch(() => {
+			branch = void 0;
+		});
+		return branch;
+	};
+	/** The code repository at its newest commit, read again each time, since updates change it. */
+	async function files() {
+		if (!read) throw new SignInError("no-access", `This sign-in has no access to ${options.repo}.`);
+		return options.open(read, await liveBranch(read));
+	}
+	/** A file as it is now: setup files are outside the folders backends list, so they're read at the newest commit. */
+	async function readNow(path) {
+		const backend = await files();
+		return backend.readAt(path, await backend.revision());
+	}
+	async function updates() {
+		if (!read) throw new SignInError("no-access", `This sign-in has no access to ${options.repo}.`);
+		const target = await liveBranch(read);
+		return githubUpdates(read, options.manage, repo, target, {
+			read: readNow,
+			readAt: async (path, revision) => (await files()).readAt(path, revision)
+		}, CODE_WORKFLOW);
+	}
+	return {
+		code: {
+			repo: options.repo,
+			webUrl: `${options.webUrl}/${options.repo}`,
+			read: readNow,
+			history: async (path, history) => (await files()).history(path, history),
+			readAt: async (path, revision) => (await files()).readAt(path, revision)
+		},
+		async setup() {
+			try {
+				return await (await updates()).setup();
+			} catch (error) {
+				if (noAccess(error)) return "no-access";
+				throw error;
+			}
+		},
+		async lastRun() {
+			try {
+				return await (await updates()).lastRun();
+			} catch (error) {
+				if (noAccess(error)) return void 0;
+				throw error;
+			}
+		},
+		async start(target) {
+			await (await updates()).start(target);
+		}
+	};
+}
 //#endregion
 //#region src/backend.ts
 /** How many files one GraphQL request reads. */
@@ -407,8 +485,10 @@ var GitHubBackend = class GitHubBackend {
 	pages;
 	editors;
 	ownerAccess;
+	/** Absent where the repository holds only content: the update job runs where the code is. */
 	updates;
 	drafts;
+	contentOnly;
 	options;
 	api;
 	repo;
@@ -429,12 +509,28 @@ var GitHubBackend = class GitHubBackend {
 		this.user = options.user;
 		this.onSignOut = options.onSignOut;
 		this.author = options.author;
+		this.pinned = options.revision;
 		const owner = githubOwnerAccess(this.api, this.repo, options.ownerTokenLink, options.ownerRedirect);
 		this.owner = owner;
 		this.ownerAccess = owner.access;
 		this.pages = githubPages(() => owner.api() ?? this.api, this.repo);
 		this.editors = githubEditors(this.api, owner.api, this.repo, this.user.login);
-		this.updates = githubUpdates(this.api, owner.api, this.repo, this.branch, this);
+		this.contentOnly = options.contentOnly === true;
+		if (!this.contentOnly) this.updates = githubUpdates(this.api, owner.api, this.repo, this.branch, this);
+		else if (options.code) this.updates = githubCodeUpdates({
+			repo: options.code.repo,
+			webUrl: options.code.webUrl,
+			read: options.code.api,
+			manage: owner.codeApi,
+			open: (api, branch) => new GitHubBackend({
+				api,
+				repo: options.code?.repo ?? "",
+				branch,
+				user: this.user,
+				onSignOut: () => {},
+				ownerTokenLink: options.ownerTokenLink
+			})
+		});
 		this.drafts = branchDrafts(this, this.draftHost());
 	}
 	/** Drafts on branches of the repository, with pull requests for review. */
@@ -584,14 +680,15 @@ var GitHubBackend = class GitHubBackend {
 		return new Map([...sizes].filter(([path]) => path.startsWith(prefix)));
 	}
 	/** Uses an owner's sign-in through the worker for editors and GitHub Pages settings, until it's forgotten. */
-	useOwnerSignIn(token, end) {
-		this.owner.useSignIn(token, end);
+	useOwnerSignIn(token, end, codeToken) {
+		this.owner.useSignIn(token, end, codeToken);
 	}
 	/** Remembers why an owner's sign-in through the worker didn't work, which the Editors and Domain screens show. */
 	ownerSignInFailed(error) {
 		this.owner.failed(error);
 	}
 	async write(changes, options) {
+		if (this.contentOnly) assertContentChanges(changes);
 		return this.author ? this.writeCommit(changes, options, this.author) : this.writeGraphQL(changes, options);
 	}
 	/**
@@ -781,7 +878,8 @@ var GitHubBackend = class GitHubBackend {
 		const response = await githubRequest(this.api, `/repos/${this.repo}/actions/runs?head_sha=${revision}&per_page=20`, { allow: [403, 404] });
 		if (!response.ok) return void 0;
 		const { workflow_runs: runs = [] } = await response.json();
-		return runs.find((run) => /deploy|pages/i.test(`${run.path ?? ""} ${run.name ?? ""}`)) ?? runs[0];
+		const builds = runs.filter((run) => !run.path?.endsWith(`/${REBUILD_JOB}.yml`));
+		return builds.find((run) => /deploy|pages/i.test(`${run.path ?? ""} ${run.name ?? ""}`)) ?? builds[0];
 	}
 	/** Which step of a failed run failed. */
 	async runProblem(run) {
@@ -814,8 +912,6 @@ var GitHubBackend = class GitHubBackend {
 * repository, lasting an hour. Requests are sent as plain text, so browsers
 * send them straight away without asking the worker first.
 */
-/** The sign-in worker Goodfellow runs for every site. Sites can run their own and name it in `github({ signIn })`. */
-const GOODFELLOW_SIGN_IN = "https://sign-in.goodfellow-cms.workers.dev";
 /** The worker's problems, as the admin panel's sign-in problems. */
 const PROBLEMS = {
 	invalid: "invalid",
@@ -935,32 +1031,46 @@ var SignInService = class {
 		});
 		return `${this.url}/github/start?${query}`;
 	}
-	/** Exchanges the grant the worker came back with, and this tab's verifier, for a session (and for a site, its first token). */
-	session(grant, verifier) {
+	/**
+	* Exchanges the grant the worker came back with, and this tab's verifier,
+	* for a session (and for a site, its first token, and with `code`, one for
+	* its code repository).
+	*/
+	session(grant, verifier, code) {
 		return this.post("/github/session", {
 			grant,
-			verifier
+			verifier,
+			...code && { code }
 		});
 	}
-	token(session) {
-		return this.post("/github/token", { session });
+	token(session, code) {
+		return this.post("/github/token", {
+			session,
+			...code && { code }
+		});
 	}
 };
 /** A token that renews itself through the worker before it expires, or when GitHub stops accepting it. */
-function renewingToken(service, first, onRenew) {
+function renewingToken(service, first, onRenew, code) {
 	let current = first;
 	let renewing;
+	async function token({ refresh = false } = {}) {
+		if (refresh || Date.parse(current.expiresAt) - 3e5 < Date.now()) {
+			renewing ??= service.token(current.session, code).finally(() => {
+				renewing = void 0;
+			});
+			current = await renewing;
+			onRenew(current);
+		}
+		return current.token;
+	}
 	return {
 		current: () => current,
-		async token({ refresh = false } = {}) {
-			if (refresh || Date.parse(current.expiresAt) - 3e5 < Date.now()) {
-				renewing ??= service.token(current.session).finally(() => {
-					renewing = void 0;
-				});
-				current = await renewing;
-				onRenew(current);
-			}
-			return current.token;
+		token,
+		async codeToken(options) {
+			await token(options);
+			if (!current.code) throw new SignInError("no-access", "The sign-in service gave no token for the code repository.");
+			return current.code.token;
 		}
 	};
 }
@@ -970,8 +1080,9 @@ function renewingToken(service, first, onRenew) {
 const MAIN = "main";
 /**
 * Links to GitHub's token pages with what creating a site needs: creating the
-* repository (administration), writing its files and its build setup
-* (contents and workflows), and turning on GitHub Pages (pages).
+* repository and adding deploy keys (administration), writing its files and
+* its build setup (contents and workflows), turning on GitHub Pages (pages),
+* and giving a workflow the key to another of the site's repositories (secrets).
 */
 function githubSetupTokenLinks(webUrl = "https://github.com") {
 	const fineGrained = new URLSearchParams({
@@ -981,7 +1092,8 @@ function githubSetupTokenLinks(webUrl = "https://github.com") {
 		administration: "write",
 		contents: "write",
 		workflows: "write",
-		pages: "write"
+		pages: "write",
+		secrets: "write"
 	});
 	const classic = new URLSearchParams({
 		scopes: "repo,workflow",
@@ -994,6 +1106,8 @@ function githubSetupTokenLinks(webUrl = "https://github.com") {
 }
 /** The steps after the repository exists, which are the same however it was created. */
 function setupAccount(creator) {
+	/** Each repository created, and the token for setting it up, for connecting it to another one later. */
+	const createdApis = /* @__PURE__ */ new Map();
 	/** Makes `main` the default branch, which the deploy setups build from. */
 	async function useMainBranch(api, repo) {
 		if (repo.default_branch === MAIN) return;
@@ -1108,6 +1222,53 @@ function setupAccount(creator) {
 			]
 		})).ok;
 	}
+	/**
+	* Lets each private repository's workflows read the other, as their setup
+	* files say: a read-only deploy key on the one read, with its private half
+	* a secret of the one reading. Public repositories need nothing. Returns
+	* whether it worked: an older sign-in may not be allowed to set secrets.
+	*/
+	async function connectRepositories(link) {
+		if (!link.private) return true;
+		const { newDeployKey, sealSecret } = await import("./deploy-keys-DAj2oX-N.js").then((n) => n.t);
+		try {
+			for (const { reader, read, secret } of link.links.reads) {
+				if (!secret) continue;
+				const readerRepo = link[reader];
+				const readRepo = link[read];
+				const readerApi = createdApis.get(readerRepo.toLowerCase());
+				const readApi = createdApis.get(readRepo.toLowerCase());
+				if (!readerApi || !readApi) throw new Error(`${readerRepo} and ${readRepo} have to be created first.`);
+				const key = await newDeployKey(`goodfellow-${secret.toLowerCase()}`);
+				await githubRequest(readApi, `/repos/${repoPath(readRepo)}/keys`, {
+					method: "POST",
+					body: {
+						title: `${readerRepo}'s builds`,
+						key: key.publicKey,
+						read_only: true
+					}
+				});
+				const base = `/repos/${repoPath(readerRepo)}/actions/secrets`;
+				const publicKey = await githubJson(readerApi, `${base}/public-key`);
+				const sealed = await sealSecret(key.privateKey, decodeBase64(publicKey.key));
+				await githubRequest(readerApi, `${base}/${secret}`, {
+					method: "PUT",
+					body: {
+						encrypted_value: encodeBase64Bytes(sealed),
+						key_id: publicKey.key_id
+					}
+				});
+			}
+			return true;
+		} catch (error) {
+			if (error instanceof GitApiError && [
+				403,
+				404,
+				422
+			].includes(error.status)) return false;
+			throw error;
+		}
+	}
 	return {
 		user: creator.user,
 		owners: () => creator.owners(),
@@ -1116,6 +1277,10 @@ function setupAccount(creator) {
 			const warnings = [];
 			onStep?.("repository");
 			const { repo, api, signInInstallUrl } = await creator.create(site);
+			const connect = async (link) => {
+				onStep?.("connect");
+				return connectRepositories(link);
+			};
 			await useMainBranch(api, repo);
 			let siteUrl;
 			if (site.pages) {
@@ -1123,6 +1288,8 @@ function setupAccount(creator) {
 				siteUrl = await turnOnPages(api, repo);
 				if (!siteUrl) warnings.push("pages-unavailable");
 			}
+			createdApis.set(repo.full_name.toLowerCase(), api);
+			if (site.link && !await connect(site.link)) warnings.push("connect-unavailable");
 			onStep?.("files");
 			await writeFiles(api, repo, site);
 			onStep?.("protection");
@@ -1233,7 +1400,8 @@ function workerCreator(service, apiUrl, fetcher, signedIn) {
 				owner: site.owner.path,
 				name: site.name,
 				private: site.private,
-				description: site.description
+				description: site.description,
+				...site.more && { more: true }
 			});
 			if (!created.repo || !created.token) throw new SignInError("unavailable", "The sign-in service didn't answer.");
 			return {
@@ -1264,7 +1432,7 @@ function githubSetup(options = {}) {
 	const links = githubSetupTokenLinks(options.webUrl);
 	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	const location = options.location ?? browserLocation();
-	const signInUrl = options.signIn === void 0 ? GOODFELLOW_SIGN_IN : options.signIn;
+	const signInUrl = options.signIn;
 	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
 	const pending = credentialStorage("goodfellow:github:setup:pending", options.storage);
 	return {
@@ -1360,14 +1528,24 @@ function githubTokenLinks(repo, webUrl = "https://github.com") {
 /** Sign-in and storage for a site whose repository is on GitHub. */
 function github(options) {
 	if (!/^[\w.-]+\/[\w.-]+$/.test(options.repo)) throw new Error(`github({ repo }) must look like "owner/name" (got "${options.repo}").`);
+	if (options.code !== void 0 && !/^[\w.-]+\/[\w.-]+$/.test(options.code)) throw new Error(`github({ code }) must look like "owner/name" (got "${options.code}").`);
 	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const webUrl = (options.webUrl ?? "https://github.com").replace(/\/$/, "");
+	/** The code repository, where the content is in a repository of its own, read with `api`. */
+	const codeRepository = (api) => options.contentOnly && options.code ? { code: {
+		repo: options.code,
+		webUrl,
+		...api && { api }
+	} } : {};
 	const links = githubTokenLinks(options.repo, options.webUrl);
 	const storage = credentialStorage(`goodfellow:github:${options.repo}`, options.storage);
 	const pending = credentialStorage(`goodfellow:github:pending:${options.repo}`, options.storage);
 	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	const location = options.location ?? browserLocation();
-	const signInUrl = options.signIn === void 0 ? GOODFELLOW_SIGN_IN : options.signIn;
+	const signInUrl = options.signIn;
 	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
+	/** The code repository to ask the worker for a token for, where the Updates screen follows it. */
+	const codeName = () => options.contentOnly ? options.code : void 0;
 	function save(value, remember) {
 		storage.save(value.type === "token" ? value.token : JSON.stringify(value), remember);
 	}
@@ -1410,7 +1588,7 @@ function github(options) {
 		const source = renewingToken(service, issued, (renewed) => save({
 			type: "worker",
 			session: renewed.session
-		}, remember));
+		}, remember), options.code);
 		save({
 			type: "worker",
 			session: issued.session
@@ -1426,6 +1604,12 @@ function github(options) {
 			api,
 			repo: options.repo,
 			branch: options.branch ?? repo.default_branch,
+			...options.contentOnly && { contentOnly: true },
+			...codeRepository({
+				apiUrl,
+				token: source.codeToken,
+				fetch: fetcher
+			}),
 			user: {
 				login: user.login,
 				name: user.name,
@@ -1437,7 +1621,7 @@ function github(options) {
 			},
 			onSignOut: () => {
 				storage.clear();
-				revokeToken(source.current().token);
+				revokeIssued(source.current());
 			},
 			ownerTokenLink: {
 				url: links.owner,
@@ -1454,12 +1638,17 @@ function github(options) {
 			fetch: fetcher
 		}, "/installation/token", { method: "DELETE" }).catch(() => {});
 	}
+	/** Revokes the tokens the worker gave: the site's, and the code repository's. */
+	function revokeIssued(issued) {
+		revokeToken(issued.token);
+		if (issued.code) revokeToken(issued.code.token);
+	}
 	/** Gives the backend an owner's sign-in that has just come back from GitHub. It's kept in memory only. */
 	async function useOwner(backend, grant, verifier) {
 		const worker = service;
 		try {
-			const source = renewingToken(worker, await worker.session(grant, verifier), () => {});
-			backend.useOwnerSignIn(source.token, () => revokeToken(source.current().token));
+			const source = renewingToken(worker, await worker.session(grant, verifier, codeName()), () => {}, codeName());
+			backend.useOwnerSignIn(source.token, () => revokeIssued(source.current()), codeName() ? source.codeToken : void 0);
 		} catch (error) {
 			backend.ownerSignInFailed(error);
 		}
@@ -1486,7 +1675,7 @@ function github(options) {
 			return backend;
 		}
 		if (failed || !grant) throw signInProblem({ problem: failed });
-		return connectWorker(await service.session(grant, redirect.verifier), redirect.remember);
+		return connectWorker(await service.session(grant, redirect.verifier, codeName()), redirect.remember);
 	}
 	async function restoreSaved() {
 		const saved = loadSaved();
@@ -1497,7 +1686,7 @@ function github(options) {
 				storage.clear();
 				return null;
 			}
-			return await connectWorker(await service.token(saved.session), storage.remembered());
+			return await connectWorker(await service.token(saved.session, codeName()), storage.remembered());
 		} catch (error) {
 			if (forgets(error)) storage.clear();
 			throw error;
@@ -1522,6 +1711,8 @@ function github(options) {
 			api,
 			repo: options.repo,
 			branch: options.branch ?? repo.default_branch,
+			...options.contentOnly && { contentOnly: true },
+			...codeRepository(api),
 			user: {
 				login: user.login,
 				name: user.name ?? void 0,
@@ -1535,6 +1726,46 @@ function github(options) {
 			...service && { ownerRedirect: (redirectOptions) => redirect("owner", false, redirectOptions) }
 		});
 	}
+	/** The repository through a token of the site's own, on a full-stack site's server. */
+	function server({ token }) {
+		const api = {
+			apiUrl,
+			token: typeof token === "string" ? token : () => token(),
+			fetch: fetcher
+		};
+		let branch;
+		const liveBranch = () => {
+			branch ??= options.branch ? Promise.resolve(options.branch) : githubJson(api, `/repos/${repoPath(options.repo)}`).then((repo) => repo.default_branch);
+			branch.catch(() => {
+				branch = void 0;
+			});
+			return branch;
+		};
+		const backend = async (revision, author) => new GitHubBackend({
+			api,
+			repo: options.repo,
+			branch: await liveBranch(),
+			...options.contentOnly && { contentOnly: true },
+			user: {
+				login: author?.name ?? options.repo,
+				...author && { name: author.name }
+			},
+			onSignOut: () => {},
+			ownerTokenLink: {
+				url: links.owner,
+				label: "owner.token.create"
+			},
+			...revision && { revision },
+			...author && { author }
+		});
+		return {
+			...options.contentOnly && { contentOnly: true },
+			async revision() {
+				return (await backend()).revision();
+			},
+			at: backend
+		};
+	}
 	return {
 		name: "GitHub",
 		canRedirect: service !== void 0,
@@ -1563,8 +1794,9 @@ function github(options) {
 		},
 		startRedirect(remember, redirectOptions) {
 			return redirect("edit", remember, redirectOptions);
-		}
+		},
+		server
 	};
 }
 //#endregion
-export { GOODFELLOW_SIGN_IN, GitHubBackend, github, githubPagesRecords, githubSetup, githubSetupTokenLinks, githubTokenLinks };
+export { GitHubBackend, github, githubPagesRecords, githubSetup, githubSetupTokenLinks, githubTokenLinks };

package/dist/testing.d.ts

@@ -20,6 +20,8 @@ export interface FakeGitHubUser {
   actions?: boolean;
   /** Whether the token may run workflows, as owner tokens can. Defaults to the `administration` setting. */
   actionsWrite?: boolean;
+  /** Whether the token may set Actions secrets and add deploy keys. Defaults to true. */
+  secrets?: boolean;
 }
 /** A GitHub Actions workflow run, with its jobs and their steps. */
 export interface FakeRun {
@@ -32,6 +34,8 @@ export interface FakeRun {
   createdAt?: string;
   status: "queued" | "in_progress" | "completed";
   conclusion: "success" | "failure" | "startup_failure" | "cancelled" | null;
+  /** The workflow's file, `.github/workflows/deploy.yml` by default. */
+  path?: string;
   jobs: Array<{
     name: string;
     conclusion: string | null;
@@ -127,6 +131,18 @@ export interface FakeCreatedRepo {
     build_type: string;
   };
   rulesets: unknown[];
+  /** Deploy keys added to it, by their public key. */
+  deployKeys: Array<{
+    title: string;
+    key: string;
+    read_only: boolean;
+  }>;
+  /** Its Actions secrets, opened. */
+  secrets: Map<string, string>;
+  /** The key pair GitHub seals secrets with. */
+  secretKey?: CryptoKeyPair;
+  /** People's permission on it, by login, as `collaborators/{login}/permission` says; others have none. */
+  collaborators?: Map<string, "admin" | "write" | "read">;
 }
 interface Deployment {
   id: number;
@@ -150,8 +166,13 @@ export declare function fakeGitHub(options: FakeGitHubOptions): {
     code: string;
     installation: number;
   };
-  /** Repositories created through the API, by `owner/name`. */
+  /** Repositories created through the API, or added with `addRepo()`, by `owner/name`. */
   created: Map<string, FakeCreatedRepo>;
+  addRepo: (fullName: string, repoOptions?: {
+    files?: Record<string, string>;
+    private?: boolean;
+    collaborators?: Record<string, "admin" | "write" | "read">;
+  }) => FakeCreatedRepo;
   /** The site's GitHub Pages settings, which tests can change, such as to issue the certificate. */
   pages: {
     current?: FakePages;

package/dist/testing.js

@@ -1,3 +1,4 @@
+import { n as openSealedSecret } from "./deploy-keys-DAj2oX-N.js";
 import { decodeBase64, encodeBase64Bytes } from "@goodfellow-cms/core";
 import { FakeConflictError, FakeRepo, fakeFileBytes, fakeFileFromBytes } from "@goodfellow-cms/core/testing";
 //#region src/testing.ts
@@ -192,6 +193,21 @@ function fakeGitHub(options) {
 		const [invitation] = index === -1 ? [] : invitations.splice(index, 1);
 		if (invitation) collaborators.set(login, invitation.permission === "admin" ? "admin" : "push");
 	}
+	/** Adds another repository, as if someone had made it, such as a site's code repository beside its content's. */
+	function addRepo(fullName, repoOptions = {}) {
+		const added = {
+			id: nextRepoId++,
+			fullName,
+			private: repoOptions.private === true,
+			repo: new FakeRepo(repoOptions.files ?? {}, "main"),
+			rulesets: [],
+			deployKeys: [],
+			secrets: /* @__PURE__ */ new Map(),
+			collaborators: new Map(Object.entries(repoOptions.collaborators ?? {}))
+		};
+		created.set(fullName, added);
+		return added;
+	}
 	/** Repository creation and the Git data API, for repositories created through the fake. */
 	async function handleCreated(request, path, principal) {
 		const login = principal.login;
@@ -215,7 +231,9 @@ function fakeGitHub(options) {
 				private: body.private === true,
 				description: body.description,
 				repo,
-				rulesets: []
+				rulesets: [],
+				deployKeys: [],
+				secrets: /* @__PURE__ */ new Map()
 			});
 			return json({
 				id,
@@ -234,12 +252,48 @@ function fakeGitHub(options) {
 		if (rest === "" && method === "GET") return json({
 			id: site.id,
 			full_name: site.fullName,
+			private: site.private,
 			default_branch: repo.defaultBranch,
 			permissions: {
 				push: true,
 				admin: true
 			}
 		});
+		const tree = rest.match(/^\/git\/trees\/([0-9a-f]{40})$/);
+		if (tree && method === "GET" && repo.commitAt(tree[1] ?? "")) {
+			const entries = [...repo.files(tree[1] ?? "")].map(([file, content]) => ({
+				path: file,
+				type: "blob",
+				sha: repo.blobSha(content),
+				size: fakeFileBytes(content).length
+			}));
+			return json({
+				sha: tree[1],
+				tree: entries,
+				truncated: false
+			});
+		}
+		const blob = rest.match(/^\/git\/blobs\/([0-9a-f]{40})$/);
+		if (blob && method === "GET") {
+			const content = repo.blobs.get(blob[1] ?? "");
+			if (content === void 0) return json({ message: "Not Found" }, 404);
+			return new Response(fakeFileBytes(content));
+		}
+		const contents = rest.match(/^\/contents\/(.+)$/);
+		if (contents && method === "GET") {
+			if (principal.app && !principal.permissions?.contents) return json({ message: "Resource not accessible" }, 403);
+			const file = repo.files().get(decodeURIComponent(contents[1] ?? ""));
+			if (file === void 0) return json({ message: "Not Found" }, 404);
+			return new Response(typeof file === "string" ? file : fakeFileBytes(file));
+		}
+		const permission = rest.match(/^\/collaborators\/([^/]+)\/permission$/);
+		if (permission && method === "GET") {
+			const login = decodeURIComponent(permission[1] ?? "");
+			return json({
+				permission: site.collaborators?.get(login) ?? "none",
+				user: { login }
+			});
+		}
 		if (rest === "" && method === "PATCH") {
 			const body = await request.json();
 			if (body.default_branch) {
@@ -279,6 +333,42 @@ function fakeGitHub(options) {
 				build_type: site.pages.build_type
 			}, 201);
 		}
+		const notAllowed = (permission) => principal.app ? principal.permissions?.[permission] !== "write" : principal.secrets === false;
+		if (rest === "/keys" && method === "POST") {
+			if (notAllowed("administration")) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!/^ssh-ed25519 [A-Za-z0-9+/=]+( |$)/.test(body.key)) return json({ message: "key is invalid" }, 422);
+			site.deployKeys.push({
+				title: body.title,
+				key: body.key,
+				read_only: body.read_only === true
+			});
+			return json({
+				id: site.deployKeys.length,
+				...body
+			}, 201);
+		}
+		if (rest === "/actions/secrets/public-key" && method === "GET") {
+			if (notAllowed("secrets")) return json({ message: "Resource not accessible by integration" }, 403);
+			site.secretKey ??= await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]);
+			const raw = new Uint8Array(await crypto.subtle.exportKey("raw", site.secretKey.publicKey));
+			return json({
+				key_id: `key-${site.id}`,
+				key: encodeBase64Bytes(raw)
+			});
+		}
+		const secret = rest.match(/^\/actions\/secrets\/([A-Z0-9_]+)$/);
+		if (secret && method === "PUT") {
+			if (notAllowed("secrets")) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!site.secretKey || body.key_id !== `key-${site.id}`) return json({ message: "Bad key id" }, 422);
+			try {
+				site.secrets.set(secret[1] ?? "", await openSealedSecret(decodeBase64(body.encrypted_value), site.secretKey));
+			} catch {
+				return json({ message: "Bad encrypted value" }, 422);
+			}
+			return new Response(null, { status: 201 });
+		}
 		if (rest === "/rulesets" && method === "POST") {
 			if (site.private && !options.paidPlan) return json({ message: "Upgrade to GitHub Pro" }, 403);
 			site.rulesets.push(await request.json());
@@ -814,7 +904,10 @@ function fakeGitHub(options) {
 				author: null
 			})));
 		}
-		if (rest === "/actions/workflows/deploy.yml/dispatches" && request.method === "POST") {
+		const workflowFile = rest.match(/^\/actions\/workflows\/([\w.-]+)\/(?:dispatches|runs)$/)?.[1];
+		const workflowPath = `.github/workflows/${workflowFile}`;
+		const ofWorkflow = (run) => (run.path ?? ".github/workflows/deploy.yml") === workflowPath;
+		if (workflowFile && rest.endsWith("/dispatches") && request.method === "POST") {
 			if (!(user.actionsWrite ?? user.administration)) return json({ message: "Resource not accessible by personal access token" }, 403);
 			const body = await request.json();
 			runs.push({
@@ -824,15 +917,17 @@ function fakeGitHub(options) {
 				inputs: body.inputs,
 				status: "queued",
 				conclusion: null,
+				path: workflowPath,
 				jobs: []
 			});
 			return new Response(null, { status: 204 });
 		}
-		if (rest === "/actions/workflows/deploy.yml/runs") {
+		if (workflowFile && rest.endsWith("/runs")) {
 			if (user.actions === false) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const found = runs.filter(ofWorkflow);
 			return json({
-				total_count: runs.length,
-				workflow_runs: [...runs].reverse().map((run) => ({
+				total_count: found.length,
+				workflow_runs: [...found].reverse().map((run) => ({
 					id: run.id,
 					event: run.event ?? "push",
 					head_sha: run.sha,
@@ -856,8 +951,8 @@ function fakeGitHub(options) {
 						head_sha: run.sha,
 						status: run.status,
 						conclusion: run.conclusion,
-						name: "Deploy to GitHub Pages",
-						path: ".github/workflows/deploy.yml",
+						name: run.path ? "Rebuild on Vercel" : "Deploy to GitHub Pages",
+						path: run.path ?? ".github/workflows/deploy.yml",
 						html_url: htmlUrl(run)
 					}))
 				});
@@ -913,8 +1008,9 @@ function fakeGitHub(options) {
 		commitAuthors,
 		authorize,
 		install,
-		/** Repositories created through the API, by `owner/name`. */
+		/** Repositories created through the API, or added with `addRepo()`, by `owner/name`. */
 		created,
+		addRepo,
 		/** The site's GitHub Pages settings, which tests can change, such as to issue the certificate. */
 		pages,
 		/** The repository's collaborators, by login, and invitations waiting to be accepted. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodfellow-cms/github",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Edit a Goodfellow site stored on GitHub, straight from the browser.",
   "keywords": [
     "goodfellow",
@@ -35,7 +35,9 @@
     "dist"
   ],
   "dependencies": {
-    "@goodfellow-cms/core": "0.3.0"
+    "@noble/ciphers": "2.4.0",
+    "@noble/hashes": "2.4.0",
+    "@goodfellow-cms/core": "0.4.0"
   },
   "devDependencies": {
     "@puckeditor/core": "0.23.0"