@goodfellow-cms/github 0.3.0 → 0.5.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { ConflictError, DomainError, DraftError, EditorsError, GitApiError, SetupError, SignInError, UpdatesError, branchDrafts, buildStepFor, compareReleases, credentialStorage, encodeBase64, encodeBase64Bytes, siteVersion } from "@goodfellow-cms/core";
+import { ConflictError, DomainError, DraftError, EditorsError, GitApiError, NIGHTLY_VARIABLE, REBUILD_JOB, SetupError, SignInError, UpdatesError, assertContentChanges, branchDrafts, buildStepFor, compareReleases, credentialStorage, decodeBase64, encodeBase64, encodeBase64Bytes, hostSource, nightlyMode, siteVersion } from "@goodfellow-cms/core";
 //#region src/api.ts
 /** Calls the GitHub REST or GraphQL API. Treats 401 as an expired sign-in; other errors become `GitApiError`. */
 async function githubRequest({ apiUrl, token, fetch }, path, init = {}) {
@@ -148,6 +148,8 @@ function githubEditors(read, manage, repo, login) {
 */
 function githubOwnerAccess(base, repo, tokenLink, redirect) {
 	let owner;
+	/** The owner's access to the site's code repository, where its content is kept in a repository of its own. */
+	let ownerCode;
 	let endSignIn;
 	let problem;
 	return {
@@ -177,21 +179,28 @@ function githubOwnerAccess(base, repo, tokenLink, redirect) {
 					throw error;
 				}
 				owner = api;
+				ownerCode = api;
 				problem = void 0;
 			},
 			forget() {
 				owner = void 0;
+				ownerCode = void 0;
 				endSignIn?.();
 				endSignIn = void 0;
 			}
 		},
 		api: () => owner,
-		/** Uses an owner's sign-in through the worker. `end` runs when it's forgotten. */
-		useSignIn(token, end) {
+		codeApi: () => ownerCode,
+		/** Uses an owner's sign-in through the worker, with its token for the code repository if it gave one. `end` runs when it's forgotten. */
+		useSignIn(token, end, codeToken) {
 			owner = {
 				...base,
 				token
 			};
+			ownerCode = codeToken ? {
+				...base,
+				token: codeToken
+			} : void 0;
 			endSignIn = end;
 			problem = void 0;
 		},
@@ -286,6 +295,7 @@ function githubPages(api, repo) {
 		}
 	}
 	return {
+		severalDomains: false,
 		async site() {
 			const found = await pages();
 			return found && {
@@ -319,20 +329,45 @@ function githubPages(api, repo) {
 	};
 }
 //#endregion
+//#region src/scheduled-builds.ts
+/** The starters' hourly check, which builds the site once a scheduled change has come due. */
+const SCHEDULED_WORKFLOW = ".github/workflows/scheduled.yml";
+/** Workflows that build the site, or ask another host to, each night. */
+const NIGHTLY_WORKFLOWS = [".github/workflows/deploy.yml", ".github/workflows/rebuild.yml"];
+/**
+* Scheduled changes on GitHub go live within the hour after their time, with
+* the starters' hourly check (`scheduled.yml`), which builds the site only
+* once one has come due. Sites set up without it get them with the nightly
+* build.
+*/
+function githubScheduledBuilds(read) {
+	return { async timing() {
+		const [scheduled, ...nightly] = await Promise.all([SCHEDULED_WORKFLOW, ...NIGHTLY_WORKFLOWS].map(read));
+		if (scheduled && /\bdue\b/.test(scheduled) && /\bschedule:/.test(scheduled)) return "hourly";
+		if (nightly.some((workflow) => workflow && /\bschedule:/.test(workflow))) return "nightly";
+		return "none";
+	} };
+}
+//#endregion
 //#region src/updates.ts
 /** The starters' GitHub Pages workflow, which runs `goodfellow update` each night and when it's dispatched. */
 const WORKFLOW = "deploy.yml";
-const WORKFLOW_FILE = `.github/workflows/${WORKFLOW}`;
+/** The code repository's workflow, where a site keeps its content in a repository of its own. */
+const CODE_WORKFLOW = "update.yml";
+/** The job that publishes the update, which the job that builds the site with it can't. */
+const PUBLISH_JOB = "publish-update";
 /**
 * The site's nightly update, which runs in its GitHub Pages workflow. Running
 * it now dispatches the workflow, which needs GitHub's Actions permission
 * with write access: `manage()` gives the owner token when one is in use.
 */
-function githubUpdates(read, manage, repo, branch, files) {
-	const path = `/repos/${repo}/actions/workflows/${WORKFLOW}`;
+function githubUpdates(read, manage, repo, branch, files, workflow = WORKFLOW) {
+	const path = `/repos/${repo}/actions/workflows/${workflow}`;
+	const workflowFile = `.github/workflows/${workflow}`;
 	return {
 		async setup() {
-			return (await files.read(WORKFLOW_FILE))?.includes("update --publish") ? "ready" : "missing";
+			const text = await files.read(workflowFile);
+			return text && /update --(publish|commit)\b/.test(text) ? "ready" : "missing";
 		},
 		async lastRun() {
 			const response = await githubRequest(read, `${path}/runs?branch=${encodeURIComponent(branch)}&per_page=20`, { allow: [403, 404] });
@@ -354,6 +389,11 @@ function githubUpdates(read, manage, repo, branch, files) {
 					state: "failed",
 					...base
 				};
+				const publish = jobs.find((candidate) => candidate.name === PUBLISH_JOB);
+				if (publish && publish.conclusion !== "success" && publish.conclusion !== "skipped") return {
+					state: "failed",
+					...base
+				};
 				const before = siteVersion(await files.readAt("package.json", run.head_sha) ?? "");
 				const now = siteVersion(await files.read("package.json") ?? "");
 				if (!before || !now || before === now) return {
@@ -373,30 +413,160 @@ function githubUpdates(read, manage, repo, branch, files) {
 				};
 			}
 		},
+		nightly: githubNightly(read, manage, repo, () => files.read(workflowFile)),
+		async rebuild() {
+			await dispatch({});
+		},
 		async start(target) {
+			await dispatch({ update: target });
+		}
+	};
+	/** Runs the workflow, with an update to install, or none to only build the site. */
+	async function dispatch(inputs) {
+		try {
+			await githubRequest(manage() ?? read, `${path}/dispatches`, {
+				method: "POST",
+				body: {
+					ref: branch,
+					inputs
+				}
+			});
+		} catch (error) {
+			if (error instanceof GitApiError && (error.status === 403 || error.status === 401)) throw new UpdatesError("not-allowed", "Running the site's build needs a token that can run its workflows.");
+			if (error instanceof GitApiError && (error.status === 404 || error.status === 422)) throw new UpdatesError("missing", "The site's GitHub Pages workflow doesn't update Goodfellow.");
+			throw error;
+		}
+	}
+}
+/**
+* The nightly build setting, kept in the repository variable the workflow's
+* jobs read in their conditions (`GOODFELLOW_NIGHTLY`), which needs GitHub's
+* Variables permission: the owner's sign-in, or a token that has it.
+*/
+function githubNightly(read, manage, repo, workflow) {
+	const path = `/repos/${repo}/actions/variables`;
+	const notAllowed = (error) => {
+		if (error instanceof GitApiError && (error.status === 401 || error.status === 403)) throw new UpdatesError("not-allowed", "Changing when the site rebuilds needs GitHub's Variables permission.");
+		throw error;
+	};
+	return {
+		async supported() {
+			return (await workflow())?.includes(NIGHTLY_VARIABLE) ?? false;
+		},
+		async get() {
+			const response = await githubRequest(manage() ?? read, `${path}/${NIGHTLY_VARIABLE}`, { allow: [403, 404] });
+			if (response.status === 404) return "changed";
+			if (!response.ok) return void 0;
+			return nightlyMode((await response.json()).value);
+		},
+		async set(mode) {
+			const api = manage() ?? read;
+			if (mode === "changed") {
+				await githubRequest(api, `${path}/${NIGHTLY_VARIABLE}`, {
+					method: "DELETE",
+					allow: [404]
+				}).catch(notAllowed);
+				return;
+			}
+			const body = {
+				name: NIGHTLY_VARIABLE,
+				value: mode
+			};
+			if ((await githubRequest(api, `${path}/${NIGHTLY_VARIABLE}`, {
+				method: "PATCH",
+				body,
+				allow: [404]
+			}).catch(notAllowed)).status === 404) await githubRequest(api, path, {
+				method: "POST",
+				body
+			}).catch(notAllowed);
+		}
+	};
+}
+/** Whether an error means the sign-in can't see the code repository, or has no token for it. */
+function noAccess(error) {
+	return error instanceof SignInError && error.problem === "no-access" || error instanceof GitApiError && (error.status === 403 || error.status === 404);
+}
+/**
+* The nightly update of a site whose content is kept in a repository of its
+* own, which runs in the code repository's `update.yml`. The sign-in needs to
+* see the code repository too; where it can't, `setup()` says `no-access`.
+*/
+function githubCodeUpdates(options) {
+	const { read } = options;
+	const repo = repoPath(options.repo);
+	let branch;
+	const liveBranch = (api) => {
+		branch ??= githubJson(api, `/repos/${repo}`).then((found) => found.default_branch);
+		branch.catch(() => {
+			branch = void 0;
+		});
+		return branch;
+	};
+	/** The code repository at its newest commit, read again each time, since updates change it. */
+	async function files() {
+		if (!read) throw new SignInError("no-access", `This sign-in has no access to ${options.repo}.`);
+		return options.open(read, await liveBranch(read));
+	}
+	/** A file as it is now: setup files are outside the folders backends list, so they're read at the newest commit. */
+	async function readNow(path) {
+		const backend = await files();
+		return backend.readAt(path, await backend.revision());
+	}
+	async function updates() {
+		if (!read) throw new SignInError("no-access", `This sign-in has no access to ${options.repo}.`);
+		const target = await liveBranch(read);
+		return githubUpdates(read, options.manage, repo, target, {
+			read: readNow,
+			readAt: async (path, revision) => (await files()).readAt(path, revision)
+		}, CODE_WORKFLOW);
+	}
+	return {
+		code: {
+			repo: options.repo,
+			webUrl: `${options.webUrl}/${options.repo}`,
+			read: readNow,
+			history: async (path, history) => (await files()).history(path, history),
+			readAt: async (path, revision) => (await files()).readAt(path, revision)
+		},
+		async setup() {
 			try {
-				await githubRequest(manage() ?? read, `${path}/dispatches`, {
-					method: "POST",
-					body: {
-						ref: branch,
-						inputs: { update: target }
-					}
-				});
+				return await (await updates()).setup();
+			} catch (error) {
+				if (noAccess(error)) return "no-access";
+				throw error;
+			}
+		},
+		async lastRun() {
+			try {
+				return await (await updates()).lastRun();
 			} catch (error) {
-				if (error instanceof GitApiError && (error.status === 403 || error.status === 401)) throw new UpdatesError("not-allowed", "Running the update needs a token that can run the site's workflows.");
-				if (error instanceof GitApiError && (error.status === 404 || error.status === 422)) throw new UpdatesError("missing", "The site's GitHub Pages workflow doesn't update Goodfellow.");
+				if (noAccess(error)) return void 0;
 				throw error;
 			}
+		},
+		async start(target) {
+			await (await updates()).start(target);
+		},
+		async rebuild() {
+			await (await updates()).rebuild?.();
 		}
 	};
 }
 //#endregion
 //#region src/backend.ts
+/** Cloudflare Pages' check runs (its GitHub App is "Cloudflare Workers and Pages") and commit statuses. */
+const CLOUDFLARE = /cloudflare/i;
 /** How many files one GraphQL request reads. */
 const GRAPHQL_BATCH = 100;
 const COMMIT_MUTATION = `mutation ($input: CreateCommitOnBranchInput!) {
   createCommitOnBranch(input: $input) { commit { oid } }
 }`;
+/** The files under a folder of a tree, in order. */
+function listFrom(tree, dir) {
+	const prefix = `${dir}/`;
+	return [...tree.keys()].filter((path) => path.startsWith(prefix)).sort();
+}
 /**
 * The site's files on GitHub. Reads come from the commit `revision()` last
 * returned; saves are single commits made with GraphQL's `createCommitOnBranch`,
@@ -407,8 +577,11 @@ var GitHubBackend = class GitHubBackend {
 	pages;
 	editors;
 	ownerAccess;
+	/** Absent where the repository holds only content: the update job runs where the code is. */
 	updates;
 	drafts;
+	scheduledBuilds;
+	contentOnly;
 	options;
 	api;
 	repo;
@@ -429,13 +602,35 @@ var GitHubBackend = class GitHubBackend {
 		this.user = options.user;
 		this.onSignOut = options.onSignOut;
 		this.author = options.author;
+		this.pinned = options.revision;
 		const owner = githubOwnerAccess(this.api, this.repo, options.ownerTokenLink, options.ownerRedirect);
 		this.owner = owner;
 		this.ownerAccess = owner.access;
 		this.pages = githubPages(() => owner.api() ?? this.api, this.repo);
 		this.editors = githubEditors(this.api, owner.api, this.repo, this.user.login);
-		this.updates = githubUpdates(this.api, owner.api, this.repo, this.branch, this);
+		this.contentOnly = options.contentOnly === true;
+		if (!this.contentOnly) this.updates = githubUpdates(this.api, owner.api, this.repo, this.branch, this);
+		else if (options.code) this.updates = githubCodeUpdates({
+			repo: options.code.repo,
+			webUrl: options.code.webUrl,
+			read: options.code.api,
+			manage: owner.codeApi,
+			open: (api, branch) => new GitHubBackend({
+				api,
+				repo: options.code?.repo ?? "",
+				branch,
+				user: this.user,
+				onSignOut: () => {},
+				ownerTokenLink: options.ownerTokenLink
+			})
+		});
 		this.drafts = branchDrafts(this, this.draftHost());
+		this.scheduledBuilds = githubScheduledBuilds((path) => this.read(path));
+	}
+	async repositoryVisibility() {
+		const found = await githubJson(this.api, `/repos/${this.repo}`);
+		if (found.visibility === "internal") return "internal";
+		return found.private === false || found.visibility === "public" ? "public" : "private";
 	}
 	/** Drafts on branches of the repository, with pull requests for review. */
 	draftHost() {
@@ -468,6 +663,9 @@ var GitHubBackend = class GitHubBackend {
 				if (response.status === 404) throw new DraftError("not-found", `There's no draft ${branch}.`);
 				return (await response.json()).merge_base_commit.sha;
 			},
+			listBranches: async (prefix) => {
+				return (await githubJson(this.api, `${base}/git/matching-refs/heads/${encodeURIComponent(prefix)}`)).map((found) => found.ref.replace(/^refs\/heads\//, ""));
+			},
 			openReview: async ({ branch, title, description }) => {
 				const response = await githubRequest(this.api, `${base}/pulls`, {
 					method: "POST",
@@ -497,10 +695,13 @@ var GitHubBackend = class GitHubBackend {
 		};
 	}
 	async revision() {
-		const ref = await githubJson(this.api, `/repos/${this.repo}/git/ref/heads/${encodeURIComponent(this.branch)}`);
-		this.pinned = ref.object.sha;
+		this.pinned = await this.head();
 		return this.pinned;
 	}
+	/** The branch's latest commit, without moving the revision reads are pinned to. */
+	async head() {
+		return (await githubJson(this.api, `/repos/${this.repo}/git/ref/heads/${encodeURIComponent(this.branch)}`)).object.sha;
+	}
 	/** Path → blob id for every file at a commit. Commits never change, so this is cached. */
 	tree(sha) {
 		let tree = this.trees.get(sha);
@@ -535,7 +736,9 @@ var GitHubBackend = class GitHubBackend {
 	}
 	/** Reads many text files in a few GraphQL requests rather than one request each. */
 	async readFiles(paths) {
-		const tree = await this.currentTree();
+		return this.readFilesFrom(await this.currentTree(), paths);
+	}
+	async readFilesFrom(tree, paths) {
 		const wanted = paths.flatMap((path) => {
 			const sha = tree.get(path);
 			return sha ? [[path, sha]] : [];
@@ -568,14 +771,24 @@ var GitHubBackend = class GitHubBackend {
 		return result;
 	}
 	async readBytes(path) {
-		const sha = (await this.currentTree()).get(path);
+		return this.bytesFrom(await this.currentTree(), path);
+	}
+	async bytesFrom(tree, path) {
+		const sha = tree.get(path);
 		if (!sha) return void 0;
 		const response = await githubRequest(this.api, `/repos/${this.repo}/git/blobs/${sha}`, { accept: "application/vnd.github.raw+json" });
 		return new Uint8Array(await response.arrayBuffer());
 	}
 	async list(dir) {
-		const prefix = `${dir}/`;
-		return [...(await this.currentTree()).keys()].filter((path) => path.startsWith(prefix)).sort();
+		return listFrom(await this.currentTree(), dir);
+	}
+	filesAt(revision) {
+		return {
+			read: async (path) => this.readFrom(await this.tree(revision), path),
+			readFiles: async (paths) => this.readFilesFrom(await this.tree(revision), paths),
+			readBytes: async (path) => this.bytesFrom(await this.tree(revision), path),
+			list: async (dir) => listFrom(await this.tree(revision), dir)
+		};
 	}
 	async fileSizes(dir) {
 		const prefix = `${dir}/`;
@@ -584,14 +797,15 @@ var GitHubBackend = class GitHubBackend {
 		return new Map([...sizes].filter(([path]) => path.startsWith(prefix)));
 	}
 	/** Uses an owner's sign-in through the worker for editors and GitHub Pages settings, until it's forgotten. */
-	useOwnerSignIn(token, end) {
-		this.owner.useSignIn(token, end);
+	useOwnerSignIn(token, end, codeToken) {
+		this.owner.useSignIn(token, end, codeToken);
 	}
 	/** Remembers why an owner's sign-in through the worker didn't work, which the Editors and Domain screens show. */
 	ownerSignInFailed(error) {
 		this.owner.failed(error);
 	}
 	async write(changes, options) {
+		if (this.contentOnly) assertContentChanges(changes);
 		return this.author ? this.writeCommit(changes, options, this.author) : this.writeGraphQL(changes, options);
 	}
 	/**
@@ -728,10 +942,11 @@ var GitHubBackend = class GitHubBackend {
 		return [...new Set((comparison.files ?? []).flatMap((file) => [file.filename, file.previous_filename ?? []].flat()))];
 	}
 	/**
-	* Reads the deployment GitHub Pages or Vercel created for a commit, and for
-	* GitHub Actions, the workflow run that builds it: a build that fails never
-	* creates a deployment. Before either exists, the site counts as building
-	* if it has ever been deployed.
+	* Reads the deployment GitHub Pages or Vercel created for a commit, or what
+	* Cloudflare Pages reports on it, and for GitHub Actions, the workflow run
+	* that builds it: a build that fails never creates a deployment. Before any
+	* exists, the site counts as building if it has ever been deployed, or if
+	* Cloudflare reported on the commit before.
 	*/
 	async deployStatus(revision) {
 		try {
@@ -760,7 +975,13 @@ var GitHubBackend = class GitHubBackend {
 					};
 				}
 			}
+			const cloudflare = await this.cloudflareBuild(revision);
+			if (cloudflare) return cloudflare;
 			const run = await this.workflowRun(revision);
+			if (run?.status === "completed" && run.conclusion === "cancelled") {
+				const head = await this.head();
+				if (head !== revision) return this.deployStatus(head);
+			}
 			if (run?.status === "completed" && run.conclusion !== "success" && run.conclusion !== "skipped") return {
 				state: "failed",
 				detailsUrl: run.html_url,
@@ -770,18 +991,83 @@ var GitHubBackend = class GitHubBackend {
 				state: "building",
 				detailsUrl: run.html_url
 			};
-			return { state: (await githubJson(this.api, `/repos/${this.repo}/deployments?per_page=1`)).length > 0 ? "building" : "unknown" };
+			if ((await githubJson(this.api, `/repos/${this.repo}/deployments?per_page=1`)).length > 0) return { state: "building" };
+			const parent = await this.parentOf(revision);
+			return { state: parent && await this.cloudflareBuild(parent) ? "building" : "unknown" };
 		} catch (error) {
 			if (error instanceof GitApiError) return { state: "unknown" };
 			throw error;
 		}
 	}
+	/**
+	* What Cloudflare Pages reports on a commit: a check run of its GitHub App,
+	* or a commit status, which fine-grained tokens can read where check runs
+	* need a GitHub App's permission. `undefined` if it reported nothing.
+	*/
+	async cloudflareBuild(revision) {
+		const checks = await githubRequest(this.api, `/repos/${this.repo}/commits/${revision}/check-runs?per_page=50`, { allow: [403, 404] });
+		if (checks.ok) {
+			const { check_runs: found = [] } = await checks.json();
+			const run = found.find((candidate) => CLOUDFLARE.test(`${candidate.app?.slug ?? ""} ${candidate.name}`));
+			if (run) {
+				const detailsUrl = run.details_url ?? run.html_url ?? void 0;
+				if (run.status !== "completed") return {
+					state: "building",
+					detailsUrl
+				};
+				if (run.conclusion === "success" || run.conclusion === "neutral" || run.conclusion === "skipped") return {
+					state: "live",
+					detailsUrl
+				};
+				return {
+					state: "failed",
+					detailsUrl,
+					problem: {
+						step: "build",
+						detail: run.output?.title ?? void 0
+					}
+				};
+			}
+		}
+		const statuses = await githubRequest(this.api, `/repos/${this.repo}/commits/${revision}/statuses?per_page=50`, { allow: [403, 404] });
+		if (!statuses.ok) return void 0;
+		const status = (await statuses.json()).find((candidate) => CLOUDFLARE.test(candidate.context));
+		if (!status) return void 0;
+		const detailsUrl = status.target_url ?? void 0;
+		if (status.state === "success") return {
+			state: "live",
+			detailsUrl
+		};
+		if (status.state === "pending") return {
+			state: "building",
+			detailsUrl
+		};
+		return {
+			state: "failed",
+			detailsUrl,
+			problem: {
+				step: "build",
+				detail: status.description ?? void 0
+			}
+		};
+	}
+	/** The commit a commit was made on top of, if the token can see it. */
+	async parentOf(revision) {
+		const response = await githubRequest(this.api, `/repos/${this.repo}/commits/${revision}`, { allow: [
+			403,
+			404,
+			422
+		] });
+		if (!response.ok) return void 0;
+		return (await response.json()).parents?.[0]?.sha;
+	}
 	/** The site's deploy workflow run for a commit, or `undefined` if there's none or the token can't see Actions. */
 	async workflowRun(revision) {
 		const response = await githubRequest(this.api, `/repos/${this.repo}/actions/runs?head_sha=${revision}&per_page=20`, { allow: [403, 404] });
 		if (!response.ok) return void 0;
 		const { workflow_runs: runs = [] } = await response.json();
-		return runs.find((run) => /deploy|pages/i.test(`${run.path ?? ""} ${run.name ?? ""}`)) ?? runs[0];
+		const builds = runs.filter((run) => !run.path?.endsWith(`/${REBUILD_JOB}.yml`));
+		return builds.find((run) => /deploy|pages/i.test(`${run.path ?? ""} ${run.name ?? ""}`)) ?? builds[0];
 	}
 	/** Which step of a failed run failed. */
 	async runProblem(run) {
@@ -814,8 +1100,6 @@ var GitHubBackend = class GitHubBackend {
 * repository, lasting an hour. Requests are sent as plain text, so browsers
 * send them straight away without asking the worker first.
 */
-/** The sign-in worker Goodfellow runs for every site. Sites can run their own and name it in `github({ signIn })`. */
-const GOODFELLOW_SIGN_IN = "https://sign-in.goodfellow-cms.workers.dev";
 /** The worker's problems, as the admin panel's sign-in problems. */
 const PROBLEMS = {
 	invalid: "invalid",
@@ -935,32 +1219,46 @@ var SignInService = class {
 		});
 		return `${this.url}/github/start?${query}`;
 	}
-	/** Exchanges the grant the worker came back with, and this tab's verifier, for a session (and for a site, its first token). */
-	session(grant, verifier) {
+	/**
+	* Exchanges the grant the worker came back with, and this tab's verifier,
+	* for a session (and for a site, its first token, and with `code`, one for
+	* its code repository).
+	*/
+	session(grant, verifier, code) {
 		return this.post("/github/session", {
 			grant,
-			verifier
+			verifier,
+			...code && { code }
 		});
 	}
-	token(session) {
-		return this.post("/github/token", { session });
+	token(session, code) {
+		return this.post("/github/token", {
+			session,
+			...code && { code }
+		});
 	}
 };
 /** A token that renews itself through the worker before it expires, or when GitHub stops accepting it. */
-function renewingToken(service, first, onRenew) {
+function renewingToken(service, first, onRenew, code) {
 	let current = first;
 	let renewing;
+	async function token({ refresh = false } = {}) {
+		if (refresh || Date.parse(current.expiresAt) - 3e5 < Date.now()) {
+			renewing ??= service.token(current.session, code).finally(() => {
+				renewing = void 0;
+			});
+			current = await renewing;
+			onRenew(current);
+		}
+		return current.token;
+	}
 	return {
 		current: () => current,
-		async token({ refresh = false } = {}) {
-			if (refresh || Date.parse(current.expiresAt) - 3e5 < Date.now()) {
-				renewing ??= service.token(current.session).finally(() => {
-					renewing = void 0;
-				});
-				current = await renewing;
-				onRenew(current);
-			}
-			return current.token;
+		token,
+		async codeToken(options) {
+			await token(options);
+			if (!current.code) throw new SignInError("no-access", "The sign-in service gave no token for the code repository.");
+			return current.code.token;
 		}
 	};
 }
@@ -970,8 +1268,9 @@ function renewingToken(service, first, onRenew) {
 const MAIN = "main";
 /**
 * Links to GitHub's token pages with what creating a site needs: creating the
-* repository (administration), writing its files and its build setup
-* (contents and workflows), and turning on GitHub Pages (pages).
+* repository and adding deploy keys (administration), writing its files and
+* its build setup (contents and workflows), turning on GitHub Pages (pages),
+* and giving a workflow the key to another of the site's repositories (secrets).
 */
 function githubSetupTokenLinks(webUrl = "https://github.com") {
 	const fineGrained = new URLSearchParams({
@@ -981,7 +1280,8 @@ function githubSetupTokenLinks(webUrl = "https://github.com") {
 		administration: "write",
 		contents: "write",
 		workflows: "write",
-		pages: "write"
+		pages: "write",
+		secrets: "write"
 	});
 	const classic = new URLSearchParams({
 		scopes: "repo,workflow",
@@ -994,6 +1294,8 @@ function githubSetupTokenLinks(webUrl = "https://github.com") {
 }
 /** The steps after the repository exists, which are the same however it was created. */
 function setupAccount(creator) {
+	/** Each repository created, and the token for setting it up, for connecting it to another one later. */
+	const createdApis = /* @__PURE__ */ new Map();
 	/** Makes `main` the default branch, which the deploy setups build from. */
 	async function useMainBranch(api, repo) {
 		if (repo.default_branch === MAIN) return;
@@ -1029,6 +1331,25 @@ function setupAccount(creator) {
 			throw error;
 		}
 	}
+	/** Gives the repository's Pages a domain of its own, saying whether GitHub took it. */
+	async function setDomain(api, repo, domain) {
+		try {
+			await githubRequest(api, `/repos/${repoPath(repo.full_name)}/pages`, {
+				method: "PUT",
+				body: { cname: domain }
+			});
+			return true;
+		} catch (error) {
+			if (error instanceof GitApiError && [
+				400,
+				403,
+				404,
+				409,
+				422
+			].includes(error.status)) return false;
+			throw error;
+		}
+	}
 	/** Writes every file in one commit, which replaces the starting README rather than following it. */
 	async function writeFiles(api, repo, site) {
 		const base = `/repos/${repoPath(repo.full_name)}`;
@@ -1108,6 +1429,53 @@ function setupAccount(creator) {
 			]
 		})).ok;
 	}
+	/**
+	* Lets each private repository's workflows read the other, as their setup
+	* files say: a read-only deploy key on the one read, with its private half
+	* a secret of the one reading. Public repositories need nothing. Returns
+	* whether it worked: an older sign-in may not be allowed to set secrets.
+	*/
+	async function connectRepositories(link) {
+		if (!link.private) return true;
+		const { newDeployKey, sealSecret } = await import("./deploy-keys-DAj2oX-N.js").then((n) => n.t);
+		try {
+			for (const { reader, read, secret } of link.links.reads) {
+				if (!secret) continue;
+				const readerRepo = link[reader];
+				const readRepo = link[read];
+				const readerApi = createdApis.get(readerRepo.toLowerCase());
+				const readApi = createdApis.get(readRepo.toLowerCase());
+				if (!readerApi || !readApi) throw new Error(`${readerRepo} and ${readRepo} have to be created first.`);
+				const key = await newDeployKey(`goodfellow-${secret.toLowerCase()}`);
+				await githubRequest(readApi, `/repos/${repoPath(readRepo)}/keys`, {
+					method: "POST",
+					body: {
+						title: `${readerRepo}'s builds`,
+						key: key.publicKey,
+						read_only: true
+					}
+				});
+				const base = `/repos/${repoPath(readerRepo)}/actions/secrets`;
+				const publicKey = await githubJson(readerApi, `${base}/public-key`);
+				const sealed = await sealSecret(key.privateKey, decodeBase64(publicKey.key));
+				await githubRequest(readerApi, `${base}/${secret}`, {
+					method: "PUT",
+					body: {
+						encrypted_value: encodeBase64Bytes(sealed),
+						key_id: publicKey.key_id
+					}
+				});
+			}
+			return true;
+		} catch (error) {
+			if (error instanceof GitApiError && [
+				403,
+				404,
+				422
+			].includes(error.status)) return false;
+			throw error;
+		}
+	}
 	return {
 		user: creator.user,
 		owners: () => creator.owners(),
@@ -1116,13 +1484,23 @@ function setupAccount(creator) {
 			const warnings = [];
 			onStep?.("repository");
 			const { repo, api, signInInstallUrl } = await creator.create(site);
+			const connect = async (link) => {
+				onStep?.("connect");
+				return connectRepositories(link);
+			};
 			await useMainBranch(api, repo);
 			let siteUrl;
 			if (site.pages) {
 				onStep?.("pages");
 				siteUrl = await turnOnPages(api, repo);
 				if (!siteUrl) warnings.push("pages-unavailable");
+				else if (site.domain) {
+					if (await setDomain(api, repo, site.domain)) siteUrl = `https://${site.domain}/`;
+					else warnings.push("domain-unavailable");
+				}
 			}
+			createdApis.set(repo.full_name.toLowerCase(), api);
+			if (site.link && !await connect(site.link)) warnings.push("connect-unavailable");
 			onStep?.("files");
 			await writeFiles(api, repo, site);
 			onStep?.("protection");
@@ -1233,7 +1611,8 @@ function workerCreator(service, apiUrl, fetcher, signedIn) {
 				owner: site.owner.path,
 				name: site.name,
 				private: site.private,
-				description: site.description
+				description: site.description,
+				...site.more && { more: true }
 			});
 			if (!created.repo || !created.token) throw new SignInError("unavailable", "The sign-in service didn't answer.");
 			return {
@@ -1264,7 +1643,7 @@ function githubSetup(options = {}) {
 	const links = githubSetupTokenLinks(options.webUrl);
 	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	const location = options.location ?? browserLocation();
-	const signInUrl = options.signIn === void 0 ? GOODFELLOW_SIGN_IN : options.signIn;
+	const signInUrl = options.signIn;
 	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
 	const pending = credentialStorage("goodfellow:github:setup:pending", options.storage);
 	return {
@@ -1336,7 +1715,8 @@ function githubTokenLinks(repo, webUrl = "https://github.com") {
 		expires_in: "90",
 		contents: "write",
 		deployments: "read",
-		actions: "read"
+		actions: "read",
+		statuses: "read"
 	});
 	const classic = new URLSearchParams({
 		scopes: "repo",
@@ -1349,7 +1729,8 @@ function githubTokenLinks(repo, webUrl = "https://github.com") {
 		expires_in: "1",
 		administration: "write",
 		pages: "write",
-		actions: "write"
+		actions: "write",
+		variables: "write"
 	});
 	return {
 		fineGrained: `${webUrl}/settings/personal-access-tokens/new?${fineGrained}`,
@@ -1360,14 +1741,24 @@ function githubTokenLinks(repo, webUrl = "https://github.com") {
 /** Sign-in and storage for a site whose repository is on GitHub. */
 function github(options) {
 	if (!/^[\w.-]+\/[\w.-]+$/.test(options.repo)) throw new Error(`github({ repo }) must look like "owner/name" (got "${options.repo}").`);
+	if (options.code !== void 0 && !/^[\w.-]+\/[\w.-]+$/.test(options.code)) throw new Error(`github({ code }) must look like "owner/name" (got "${options.code}").`);
 	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const webUrl = (options.webUrl ?? "https://github.com").replace(/\/$/, "");
+	/** The code repository, where the content is in a repository of its own, read with `api`. */
+	const codeRepository = (api) => options.contentOnly && options.code ? { code: {
+		repo: options.code,
+		webUrl,
+		...api && { api }
+	} } : {};
 	const links = githubTokenLinks(options.repo, options.webUrl);
 	const storage = credentialStorage(`goodfellow:github:${options.repo}`, options.storage);
 	const pending = credentialStorage(`goodfellow:github:pending:${options.repo}`, options.storage);
 	const fetcher = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	const location = options.location ?? browserLocation();
-	const signInUrl = options.signIn === void 0 ? GOODFELLOW_SIGN_IN : options.signIn;
+	const signInUrl = options.signIn;
 	const service = signInUrl && location && !isLocalAddress(location.href()) ? new SignInService(signInUrl, fetcher) : void 0;
+	/** The code repository to ask the worker for a token for, where the Updates screen follows it. */
+	const codeName = () => options.contentOnly ? options.code : void 0;
 	function save(value, remember) {
 		storage.save(value.type === "token" ? value.token : JSON.stringify(value), remember);
 	}
@@ -1410,7 +1801,7 @@ function github(options) {
 		const source = renewingToken(service, issued, (renewed) => save({
 			type: "worker",
 			session: renewed.session
-		}, remember));
+		}, remember), options.code);
 		save({
 			type: "worker",
 			session: issued.session
@@ -1426,6 +1817,12 @@ function github(options) {
 			api,
 			repo: options.repo,
 			branch: options.branch ?? repo.default_branch,
+			...options.contentOnly && { contentOnly: true },
+			...codeRepository({
+				apiUrl,
+				token: source.codeToken,
+				fetch: fetcher
+			}),
 			user: {
 				login: user.login,
 				name: user.name,
@@ -1437,7 +1834,7 @@ function github(options) {
 			},
 			onSignOut: () => {
 				storage.clear();
-				revokeToken(source.current().token);
+				revokeIssued(source.current());
 			},
 			ownerTokenLink: {
 				url: links.owner,
@@ -1454,12 +1851,17 @@ function github(options) {
 			fetch: fetcher
 		}, "/installation/token", { method: "DELETE" }).catch(() => {});
 	}
+	/** Revokes the tokens the worker gave: the site's, and the code repository's. */
+	function revokeIssued(issued) {
+		revokeToken(issued.token);
+		if (issued.code) revokeToken(issued.code.token);
+	}
 	/** Gives the backend an owner's sign-in that has just come back from GitHub. It's kept in memory only. */
 	async function useOwner(backend, grant, verifier) {
 		const worker = service;
 		try {
-			const source = renewingToken(worker, await worker.session(grant, verifier), () => {});
-			backend.useOwnerSignIn(source.token, () => revokeToken(source.current().token));
+			const source = renewingToken(worker, await worker.session(grant, verifier, codeName()), () => {}, codeName());
+			backend.useOwnerSignIn(source.token, () => revokeIssued(source.current()), codeName() ? source.codeToken : void 0);
 		} catch (error) {
 			backend.ownerSignInFailed(error);
 		}
@@ -1486,7 +1888,7 @@ function github(options) {
 			return backend;
 		}
 		if (failed || !grant) throw signInProblem({ problem: failed });
-		return connectWorker(await service.session(grant, redirect.verifier), redirect.remember);
+		return connectWorker(await service.session(grant, redirect.verifier, codeName()), redirect.remember);
 	}
 	async function restoreSaved() {
 		const saved = loadSaved();
@@ -1497,7 +1899,7 @@ function github(options) {
 				storage.clear();
 				return null;
 			}
-			return await connectWorker(await service.token(saved.session), storage.remembered());
+			return await connectWorker(await service.token(saved.session, codeName()), storage.remembered());
 		} catch (error) {
 			if (forgets(error)) storage.clear();
 			throw error;
@@ -1522,6 +1924,8 @@ function github(options) {
 			api,
 			repo: options.repo,
 			branch: options.branch ?? repo.default_branch,
+			...options.contentOnly && { contentOnly: true },
+			...codeRepository(api),
 			user: {
 				login: user.login,
 				name: user.name ?? void 0,
@@ -1535,9 +1939,62 @@ function github(options) {
 			...service && { ownerRedirect: (redirectOptions) => redirect("owner", false, redirectOptions) }
 		});
 	}
+	/** The repository through a token of the site's own, on a full-stack site's server. */
+	function server({ token }) {
+		const api = {
+			apiUrl,
+			token: typeof token === "string" ? token : () => token(),
+			fetch: fetcher
+		};
+		let branch;
+		const liveBranch = () => {
+			branch ??= options.branch ? Promise.resolve(options.branch) : githubJson(api, `/repos/${repoPath(options.repo)}`).then((repo) => repo.default_branch);
+			branch.catch(() => {
+				branch = void 0;
+			});
+			return branch;
+		};
+		const backend = async (revision, author) => new GitHubBackend({
+			api,
+			repo: options.repo,
+			branch: await liveBranch(),
+			...options.contentOnly && { contentOnly: true },
+			user: {
+				login: author?.name ?? options.repo,
+				...author && { name: author.name }
+			},
+			onSignOut: () => {},
+			ownerTokenLink: {
+				url: links.owner,
+				label: "owner.token.create"
+			},
+			...revision && { revision },
+			...author && { author }
+		});
+		return {
+			...options.contentOnly && { contentOnly: true },
+			async revision() {
+				return (await backend()).revision();
+			},
+			at: backend
+		};
+	}
 	return {
 		name: "GitHub",
+		source: hostSource("@goodfellow-cms/github", "github", options, [
+			"fetch",
+			"storage",
+			"location"
+		]),
 		canRedirect: service !== void 0,
+		setup: () => githubSetup({
+			...options.apiUrl && { apiUrl: options.apiUrl },
+			...options.webUrl && { webUrl: options.webUrl },
+			...options.fetch && { fetch: options.fetch },
+			...options.storage && { storage: options.storage },
+			...options.location && { location: options.location },
+			signIn: false
+		}),
 		tokenLinks: [{
 			url: links.fineGrained,
 			label: "signIn.token.create"
@@ -1563,8 +2020,9 @@ function github(options) {
 		},
 		startRedirect(remember, redirectOptions) {
 			return redirect("edit", remember, redirectOptions);
-		}
+		},
+		server
 	};
 }
 //#endregion
-export { GOODFELLOW_SIGN_IN, GitHubBackend, github, githubPagesRecords, githubSetup, githubSetupTokenLinks, githubTokenLinks };
+export { GitHubBackend, github, githubPagesRecords, githubSetup, githubSetupTokenLinks, githubTokenLinks };