@heychunky/core 0.1.0

package/dist/admin/services/bunny.js

@@ -0,0 +1,59 @@
+/**
+ * Bunny.net — storage zones and CDN.
+ *
+ * Authenticates with an `AccessKey` header, not Bearer.
+ *
+ * **Fields are picked, never spread.** Bunny returns each storage zone's
+ * `Password` and `ReadOnlyPassword`, and each pull zone's `ZoneSecurityKey`
+ * and `AWSSigningSecret`, in the same payload as the name and size. Declaring
+ * an interface without them strips nothing at runtime — the object still
+ * carries them, and printing it puts live credentials on a terminal. That
+ * happened once; hence the mapping below.
+ */
+import { request } from "../../http/request.js";
+import { baseName } from "../../config/names.js";
+import { probe, probeAccess } from "../../services/types.js";
+const BASE = "https://api.bunny.net";
+export function bunny(token) {
+    const creds = { token, header: "AccessKey" };
+    async function storageZones() {
+        const res = await request(`${BASE}/storagezone`, { credentials: creds });
+        const raw = Array.isArray(res) ? res : (res.Items ?? []);
+        return raw.map((z) => ({
+            Id: z.Id,
+            Name: z.Name,
+            Region: z.Region,
+            StorageUsed: z.StorageUsed,
+            FilesStored: z.FilesStored,
+        }));
+    }
+    return {
+        storageZones,
+        /** Zones for one app, by the `<app>` / `<app>-private` convention. */
+        async zonesForApp(app) {
+            const base = baseName(app);
+            return (await storageZones()).filter((z) => z.Name === base || z.Name.startsWith(`${base}-`));
+        },
+        async status() {
+            return probe("bunny", async () => {
+                const z = await storageZones();
+                const gb = z.reduce((n, x) => n + (x.StorageUsed ?? 0), 0) / 1e9;
+                return `${z.length} storage zones, ${gb.toFixed(2)} GB stored`;
+            });
+        },
+        async access() {
+            return probeAccess("bunny", async () => {
+                const z = await storageZones();
+                return {
+                    evidence: "reachability",
+                    can: [`read and manage ${z.length} storage zones`, "create and delete zones, and their stored objects"],
+                    notes: [
+                        "account-wide key; Bunny declares nothing about a key's rights",
+                        "individual storage zones carry their own passwords, so per-app storage is scoped even where management is not",
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=bunny.js.map

package/dist/admin/services/bunny.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bunny.js","sourceRoot":"","sources":["../../../src/admin/services/bunny.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,IAAI,GAAG,uBAAuB,CAAC;AAUrC,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE1D,KAAK,UAAU,YAAY;QACzB,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,IAAI,cAAc,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,EAAY;YAClB,IAAI,EAAE,CAAC,CAAC,IAAc;YACtB,MAAM,EAAE,CAAC,CAAC,MAAgB;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAqB;YACpC,WAAW,EAAE,CAAC,CAAC,WAAiC;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO;QACL,YAAY;QACZ,sEAAsE;QACtE,KAAK,CAAC,WAAW,CAAC,GAAW;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QAChG,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC/B,MAAM,CAAC,GAAG,MAAM,YAAY,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;gBACjE,OAAO,GAAG,CAAC,CAAC,MAAM,mBAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACjE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBACrC,MAAM,CAAC,GAAG,MAAM,YAAY,EAAE,CAAC;gBAC/B,OAAO;oBACL,QAAQ,EAAE,cAAuB;oBACjC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,MAAM,gBAAgB,EAAE,mDAAmD,CAAC;oBACvG,KAAK,EAAE;wBACL,+DAA+D;wBAC/D,+GAA+G;qBAChH;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/cloudflare.d.ts

@@ -0,0 +1,42 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface Zone {
+    id: string;
+    name: string;
+    status: string;
+    account: {
+        id: string;
+        name: string;
+    };
+}
+export interface DnsRecord {
+    id: string;
+    type: string;
+    name: string;
+    content: string;
+    proxied: boolean;
+    ttl: number;
+}
+export declare function cloudflare(token: string): {
+    zones: () => Promise<Zone[]>;
+    zone: (name: string) => Promise<Zone>;
+    dnsRecords(domain: string): Promise<DnsRecord[]>;
+    /**
+     * Add one DNS record, replacing a record of the same type and name.
+     *
+     * Replacing rather than adding is what makes this safe to run twice: a
+     * second attempt at a verification record would otherwise leave two
+     * conflicting values and the domain would verify intermittently or not at
+     * all. TXT records that legitimately coexist — several SPF includes, say —
+     * belong in one value, not several records.
+     */
+    setDnsRecord(domain: string, record: {
+        type: string;
+        name: string;
+        content: string;
+        ttl?: number;
+        priority?: number;
+    }): Promise<DnsRecord>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=cloudflare.d.ts.map

package/dist/admin/services/cloudflare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../../src/admin/services/cloudflare.ts"],"names":[],"mappings":"AASA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAIrG,MAAM,WAAW,IAAI;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE;AACzG,MAAM,WAAW,SAAS;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAErH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM;;iBAeZ,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;uBASrB,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAItD;;;;;;;;OAQG;yBAEO,MAAM,UACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACvF,OAAO,CAAC,SAAS,CAAC;cAYL,OAAO,CAAC,aAAa,CAAC;cAQtB,OAAO,CAAC,aAAa,CAAC;EA8BzC"}

package/dist/admin/services/cloudflare.js

@@ -0,0 +1,97 @@
+/**
+ * Cloudflare — DNS, and the registrar.
+ *
+ * Cloudflare returns HTTP 200 for application-level failures, wrapping every
+ * response in `{ success, errors, result }`. A token missing a permission comes
+ * back 200 with `success: false`, so a plain fetch reads a permissions error as
+ * a zone with no records. Everything here unwraps and throws.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+const CF = "https://api.cloudflare.com/client/v4";
+export function cloudflare(token) {
+    const creds = { token };
+    async function cf(path, init = {}) {
+        const res = await request(`${CF}${path}`, { credentials: creds, ...init });
+        if (!res.success) {
+            const why = res.errors?.map((e) => `${e.code} ${e.message}`).join("; ") || "unknown error";
+            throw new Error(`Cloudflare ${path}: ${why}`);
+        }
+        return res.result;
+    }
+    const zones = () => cf("/zones?per_page=100");
+    async function zone(name) {
+        const found = await cf(`/zones?name=${encodeURIComponent(name)}`);
+        if (!found.length)
+            throw new Error(`No Cloudflare zone for "${name}" on this token's account`);
+        return found[0];
+    }
+    return {
+        zones,
+        zone,
+        async dnsRecords(domain) {
+            return cf(`/zones/${(await zone(domain)).id}/dns_records?per_page=100`);
+        },
+        /**
+         * Add one DNS record, replacing a record of the same type and name.
+         *
+         * Replacing rather than adding is what makes this safe to run twice: a
+         * second attempt at a verification record would otherwise leave two
+         * conflicting values and the domain would verify intermittently or not at
+         * all. TXT records that legitimately coexist — several SPF includes, say —
+         * belong in one value, not several records.
+         */
+        async setDnsRecord(domain, record) {
+            const zoneId = (await zone(domain)).id;
+            const query = new URLSearchParams({ type: record.type, name: record.name });
+            for (const existing of await cf(`/zones/${zoneId}/dns_records?${query}`)) {
+                await cf(`/zones/${zoneId}/dns_records/${existing.id}`, { method: "DELETE" });
+            }
+            return await cf(`/zones/${zoneId}/dns_records`, {
+                method: "POST",
+                body: { ttl: 1, ...record },
+            });
+        },
+        async status() {
+            return probe("cloudflare", async () => {
+                const z = await zones();
+                const inactive = z.filter((x) => x.status !== "active").length;
+                return `${z.length} zone${z.length === 1 ? "" : "s"}${inactive ? ` ⚠️ ${inactive} not active` : ""}`;
+            });
+        },
+        async access() {
+            return probeAccess("cloudflare", async () => {
+                const [check, z] = await Promise.all([
+                    cf("/user/tokens/verify"),
+                    zones(),
+                ]);
+                // DNS is probed, never assumed: a token with Zone:Edit but no DNS
+                // permission lists zones happily and fails on records.
+                let dns;
+                if (z[0]) {
+                    try {
+                        await cf(`/zones/${z[0].id}/dns_records?per_page=1`);
+                        dns = `read DNS records on those zones (probed ${z[0].name})`;
+                    }
+                    catch {
+                        dns = undefined;
+                    }
+                }
+                const accounts = [...new Set(z.map((x) => x.account.name))];
+                const notes = [
+                    `token ${check.id.slice(0, 8)}… is ${check.status}`,
+                    check.expires_on ? `expires ${check.expires_on.slice(0, 10)}` : "does not expire",
+                ];
+                if (z.length && !dns)
+                    notes.push("cannot read DNS records — missing Zone:DNS, so every DNS step will fail");
+                notes.push("write access is never probed: proving it means writing a record");
+                return {
+                    evidence: "identity",
+                    can: [`read ${z.length} zones on ${accounts.join(", ") || "no account"}`, ...(dns ? [dns] : [])],
+                    notes,
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/admin/services/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../../src/admin/services/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,EAAE,GAAG,sCAAsC,CAAC;AAKlD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IAErC,KAAK,UAAU,EAAE,CAAI,IAAY,EAAE,OAA+D,EAAE;QAClG,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,CAAS,qBAAqB,CAAC,CAAC;IAEtD,KAAK,UAAU,IAAI,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAS,eAAe,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,2BAA2B,CAAC,CAAC;QAC/F,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI;QACJ,KAAK,CAAC,UAAU,CAAC,MAAc;YAC7B,OAAO,EAAE,CAAc,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;QACvF,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,MAAwF;YAExF,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAc,UAAU,MAAM,gBAAgB,KAAK,EAAE,CAAC,EAAE,CAAC;gBACtF,MAAM,EAAE,CAAC,UAAU,MAAM,gBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,MAAM,EAAE,CAAY,UAAU,MAAM,cAAc,EAAE;gBACzD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;gBAC/D,OAAO,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACvG,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBAC1C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACnC,EAAE,CAAsD,qBAAqB,CAAC;oBAC9E,KAAK,EAAE;iBACR,CAAC,CAAC;gBACH,kEAAkE;gBAClE,uDAAuD;gBACvD,IAAI,GAAuB,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,EAAE,CAAc,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;wBAClE,GAAG,GAAG,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;oBAChE,CAAC;oBAAC,MAAM,CAAC;wBAAC,GAAG,GAAG,SAAS,CAAC;oBAAC,CAAC;gBAC9B,CAAC;gBACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5D,MAAM,KAAK,GAAG;oBACZ,SAAS,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE;oBACnD,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB;iBAClF,CAAC;gBACF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;gBAC5G,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;gBAC9E,OAAO;oBACL,QAAQ,EAAE,UAAmB;oBAC7B,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,MAAM,aAAa,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAChG,KAAK;iBACN,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/db.d.ts

@@ -0,0 +1,16 @@
+export interface Rows {
+    rows: Record<string, unknown>[];
+    rowCount: number;
+}
+export interface Column {
+    column: string;
+    type: string;
+    nullable: boolean;
+}
+export declare function db(connectionString: string): {
+    query: (sql: string, params?: unknown[]) => Promise<Rows>;
+    write: (sql: string, params?: unknown[]) => Promise<Rows>;
+    tables(): Promise<string[]>;
+    columns(table: string): Promise<Column[]>;
+};
+//# sourceMappingURL=db.d.ts.map

package/dist/admin/services/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../src/admin/services/db.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,EAAE,CAAC,gBAAgB,EAAE,MAAM;iBAuCf,MAAM,WAAU,OAAO,EAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;iBAU9C,MAAM,WAAU,OAAO,EAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;cAYtD,OAAO,CAAC,MAAM,EAAE,CAAC;mBAOZ,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;EAelD"}

package/dist/admin/services/db.js

@@ -0,0 +1,81 @@
+/**
+ * An app's own database, reached by its connection string.
+ *
+ * Separate from `neon.ts` on purpose. That is the control plane — an API key
+ * that can create and delete every project in the organisation. This is the
+ * data plane, and the two have different blast radii, which is exactly what the
+ * `app` tier on these actions means.
+ *
+ * Spoken over Neon's HTTP SQL endpoint rather than through a Postgres driver.
+ * The Core ships to other people and runs in an edge function as readily as in
+ * Node; one query path should not drag a connection pool, TLS handling and a
+ * native binding behind it. The same reason `infisical.ts` is written against
+ * `fetch`.
+ */
+import { errorFor } from "../../http/errors.js";
+export function db(connectionString) {
+    let host;
+    try {
+        host = new URL(connectionString).hostname;
+    }
+    catch {
+        throw new Error("Not a connection string — expected postgres://user:password@host/database");
+    }
+    const endpoint = `https://${host}/sql`;
+    async function send(body, headers = {}) {
+        const res = await fetch(endpoint, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "Neon-Connection-String": connectionString,
+                ...headers,
+            },
+            body: JSON.stringify(body),
+        });
+        const parsed = (await res.json());
+        if (!res.ok) {
+            // Postgres's own message names the column or the constraint; a status
+            // code alone sends someone to the wrong place. errorFor classifies it,
+            // so a worker knows a syntax error will never succeed on retry.
+            throw errorFor(res.status, endpoint, parsed.message ?? JSON.stringify(parsed));
+        }
+        return parsed;
+    }
+    /**
+     * Read-only SQL.
+     *
+     * Sent as a batch so Postgres opens a READ ONLY transaction around it, which
+     * refuses a write itself. The guarantee is the database's, not this client's
+     * — a promise kept by parsing the statement here would be worth very little.
+     */
+    async function query(sql, params = []) {
+        const body = (await send({ queries: [{ query: sql, params }] }, { "Neon-Batch-Read-Only": "true" }));
+        const first = body.results?.[0];
+        return { rows: first?.rows ?? [], rowCount: first?.rowCount ?? 0 };
+    }
+    /** SQL that may change data. Gated in the registry, not here. */
+    async function write(sql, params = []) {
+        const body = (await send({ query: sql, params }));
+        return { rows: body.rows ?? [], rowCount: body.rowCount ?? 0 };
+    }
+    return {
+        query,
+        write,
+        async tables() {
+            const { rows } = await query("select tablename from pg_tables where schemaname = 'public' order by tablename");
+            return rows.map((r) => String(r["tablename"]));
+        },
+        async columns(table) {
+            const { rows } = await query(`select column_name, data_type, is_nullable
+           from information_schema.columns
+          where table_schema = 'public' and table_name = $1
+          order by ordinal_position`, [table]);
+            return rows.map((r) => ({
+                column: String(r["column_name"]),
+                type: String(r["data_type"]),
+                nullable: r["is_nullable"] === "YES",
+            }));
+        },
+    };
+}
+//# sourceMappingURL=db.js.map

package/dist/admin/services/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/admin/services/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAahD,MAAM,UAAU,EAAE,CAAC,gBAAwB;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,IAAI,MAAM,CAAC;IAEvC,KAAK,UAAU,IAAI,CACjB,IAAa,EACb,UAAkC,EAAE;QAEpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,wBAAwB,EAAE,gBAAgB;gBAC1C,GAAG,OAAO;aACX;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,sEAAsE;YACtE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,SAAoB,EAAE;QACtD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CACtB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EACrC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CACnC,CAA4E,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,iEAAiE;IACjE,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,SAAoB,EAAE;QACtD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAG/C,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK;QAEL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAC1B,gFAAgF,CACjF,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAa;YACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAC1B;;;oCAG4B,EAC5B,CAAC,KAAK,CAAC,CACR,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC5B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,KAAK;aACrC,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/elevenlabs.d.ts

@@ -0,0 +1,22 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface ElevenLabsSubscription {
+    tier: string;
+    status: string;
+    character_count: number;
+    character_limit: number;
+    next_character_count_reset_unix: number;
+}
+export declare function elevenlabs(token: string): {
+    subscription: () => Promise<ElevenLabsSubscription>;
+    voices: () => Promise<{
+        voice_id: string;
+        name: string;
+    }[]>;
+    models: () => Promise<{
+        model_id: string;
+        name: string;
+    }[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=elevenlabs.d.ts.map

package/dist/admin/services/elevenlabs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevenlabs.d.ts","sourceRoot":"","sources":["../../../src/admin/services/elevenlabs.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErG,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,+BAA+B,EAAE,MAAM,CAAC;CACzC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM;;;kBAM0B,MAAM;cAAQ,MAAM;;;kBAKhD,MAAM;cAAQ,MAAM;;cACtC,OAAO,CAAC,aAAa,CAAC;cAQtB,OAAO,CAAC,aAAa,CAAC;EAkBzC"}

package/dist/admin/services/elevenlabs.js

@@ -0,0 +1,45 @@
+/**
+ * ElevenLabs — voice.
+ *
+ * Authenticates with `xi-api-key`, not Bearer.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+export function elevenlabs(token) {
+    // Not Bearer — ElevenLabs wants its own header.
+    const creds = { token, header: "xi-api-key" };
+    const BASE = "https://api.elevenlabs.io/v1";
+    const subscription = () => request(`${BASE}/user/subscription`, { credentials: creds });
+    const voices = async () => (await request(`${BASE}/voices`, { credentials: creds })).voices;
+    return {
+        subscription,
+        voices,
+        models: () => request(`${BASE}/models`, { credentials: creds }),
+        async status() {
+            return probe("elevenlabs", async () => {
+                const s = await subscription();
+                const left = s.character_limit - s.character_count;
+                const resets = new Date(s.next_character_count_reset_unix * 1000).toISOString().slice(0, 10);
+                return `${s.tier} (${s.status}) · ${left.toLocaleString()} of ${s.character_limit.toLocaleString()} characters left, resets ${resets}`;
+            });
+        },
+        async access() {
+            return probeAccess("elevenlabs", async () => {
+                const [s, v] = await Promise.all([subscription(), voices()]);
+                return {
+                    evidence: "identity",
+                    can: [
+                        `act on the ${s.tier} plan (${s.status}), ${s.character_limit.toLocaleString()} characters per period`,
+                        `use ${v.length} voices`,
+                        "create and delete voices, and spend the character quota",
+                    ],
+                    notes: [
+                        "account-wide key; ElevenLabs cannot scope one to a voice or project",
+                        "spending is metered, not gated",
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=elevenlabs.js.map

package/dist/admin/services/elevenlabs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevenlabs.js","sourceRoot":"","sources":["../../../src/admin/services/elevenlabs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAUrG,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,gDAAgD;IAChD,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,8BAA8B,CAAC;IAE5C,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAyB,GAAG,IAAI,oBAAoB,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAAmD,GAAG,IAAI,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAE9I,OAAO;QACL,YAAY;QACZ,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAuC,GAAG,IAAI,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACrG,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,CAAC,GAAG,MAAM,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7F,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,OAAO,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,cAAc,EAAE,4BAA4B,MAAM,EAAE,CAAC;YACzI,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBAC1C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC7D,OAAO;oBACL,QAAQ,EAAE,UAAU;oBACpB,GAAG,EAAE;wBACH,cAAc,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,eAAe,CAAC,cAAc,EAAE,wBAAwB;wBACtG,OAAO,CAAC,CAAC,MAAM,SAAS;wBACxB,yDAAyD;qBAC1D;oBACD,KAAK,EAAE;wBACL,qEAAqE;wBACrE,gCAAgC;qBACjC;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/firecrawl.d.ts

@@ -0,0 +1,13 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface FirecrawlCredits {
+    remaining_credits: number;
+    plan_credits: number;
+    billing_period_end: string;
+}
+export declare function firecrawl(token: string): {
+    credits: () => Promise<FirecrawlCredits>;
+    scrape(url: string): Promise<unknown>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=firecrawl.d.ts.map

package/dist/admin/services/firecrawl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecrawl.d.ts","sourceRoot":"","sources":["../../../src/admin/services/firecrawl.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErG,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM;mBAIX,OAAO,CAAC,gBAAgB,CAAC;gBAO/B,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAG3B,OAAO,CAAC,aAAa,CAAC;cAMtB,OAAO,CAAC,aAAa,CAAC;EAWzC"}

package/dist/admin/services/firecrawl.js

@@ -0,0 +1,36 @@
+/**
+ * Firecrawl — crawling and scraping. Metered by credits.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+export function firecrawl(token) {
+    const creds = { token };
+    const BASE = "https://api.firecrawl.dev/v1";
+    async function credits() {
+        const { data } = await request(`${BASE}/team/credit-usage`, { credentials: creds });
+        return data;
+    }
+    return {
+        credits,
+        async scrape(url) {
+            return request(`${BASE}/scrape`, { method: "POST", credentials: creds, body: { url } });
+        },
+        async status() {
+            return probe("firecrawl", async () => {
+                const c = await credits();
+                return `${c.remaining_credits} of ${c.plan_credits} credits, period ends ${c.billing_period_end.slice(0, 10)}`;
+            });
+        },
+        async access() {
+            return probeAccess("firecrawl", async () => {
+                const c = await credits();
+                return {
+                    evidence: "reachability",
+                    can: ["crawl and scrape any URL", `spend ${c.remaining_credits} remaining credits`],
+                    notes: ["account-wide key", "spending is metered, not gated"],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=firecrawl.js.map

package/dist/admin/services/firecrawl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecrawl.js","sourceRoot":"","sources":["../../../src/admin/services/firecrawl.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAQrG,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,8BAA8B,CAAC;IAE5C,KAAK,UAAU,OAAO;QACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAA6B,GAAG,IAAI,oBAAoB,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO;QACP,KAAK,CAAC,MAAM,CAAC,GAAW;YACtB,OAAO,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACnC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,YAAY,yBAAyB,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACjH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACzC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC1B,OAAO;oBACL,QAAQ,EAAE,cAAc;oBACxB,GAAG,EAAE,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC,iBAAiB,oBAAoB,CAAC;oBACnF,KAAK,EAAE,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;iBAC9D,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/fireworks.d.ts

@@ -0,0 +1,9 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export declare function fireworks(token: string): {
+    models: () => Promise<{
+        id: string;
+    }[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=fireworks.d.ts.map

package/dist/admin/services/fireworks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fireworks.d.ts","sourceRoot":"","sources":["../../../src/admin/services/fireworks.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM;kBAKZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;cAOhC,OAAO,CAAC,aAAa,CAAC;cAGtB,OAAO,CAAC,aAAa,CAAC;EAQzC"}

package/dist/admin/services/fireworks.js

@@ -0,0 +1,31 @@
+/**
+ * Fireworks AI — inference.
+ *
+ * Note the `/inference` prefix: api.fireworks.ai/v1/models is a 404, and a 404
+ * that yields an empty list reads as "no models" rather than "wrong URL".
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+export function fireworks(token) {
+    const creds = { token };
+    // Note the /inference prefix — api.fireworks.ai/v1/models is a 404.
+    const BASE = "https://api.fireworks.ai/inference/v1";
+    async function models() {
+        const { data } = await request(`${BASE}/models`, { credentials: creds });
+        return data;
+    }
+    return {
+        models,
+        async status() {
+            return probe("fireworks", async () => `${(await models()).length} models`);
+        },
+        async access() {
+            return probeAccess("fireworks", async () => ({
+                evidence: "reachability",
+                can: [`run inference against ${(await models()).length} models`],
+                notes: ["account-wide key; Fireworks declares nothing about a key's rights"],
+            }));
+        },
+    };
+}
+//# sourceMappingURL=fireworks.js.map

package/dist/admin/services/fireworks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fireworks.js","sourceRoot":"","sources":["../../../src/admin/services/fireworks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,oEAAoE;IACpE,MAAM,IAAI,GAAG,uCAAuC,CAAC;IAErD,KAAK,UAAU,MAAM;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAA6B,GAAG,IAAI,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM;QACN,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC3C,QAAQ,EAAE,cAAc;gBACxB,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC;gBAChE,KAAK,EAAE,CAAC,mEAAmE,CAAC;aAC7E,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/github.d.ts

@@ -0,0 +1,26 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface Repo {
+    name: string;
+    full_name: string;
+    private: boolean;
+    default_branch: string;
+    html_url: string;
+}
+export declare function github(token: string): {
+    login: () => Promise<string>;
+    listRepos: (affiliation?: string) => Promise<Repo[]>;
+    listPublicRepos: () => Promise<Repo[]>;
+    findRepo: (fullName: string) => Promise<Repo | undefined>;
+    findRepoFor: (app: string, org?: string) => Promise<Repo | undefined>;
+    createRepo: (name: string, o?: {
+        org?: string;
+        description?: string;
+    }) => Promise<Repo>;
+    deleteRepo: (fullName: string, o: {
+        confirmed: true;
+    }) => Promise<void>;
+    createBranch: (fullName: string, branch: string, from: string) => Promise<void>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=github.d.ts.map

package/dist/admin/services/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/admin/services/github.ts"],"names":[],"mappings":"AAYA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAKrG,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAaD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM;;yCAImC,OAAO,CAAC,IAAI,EAAE,CAAC;2BAYlD,OAAO,CAAC,IAAI,EAAE,CAAC;yBAaf,MAAM,KAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;uBAqBpC,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;uBAcxE,MAAM,MACT;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KACxC,OAAO,CAAC,IAAI,CAAC;2BAgBoB,MAAM,KAAK;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;6BAK5C,MAAM,UAAU,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;cAkBxE,OAAO,CAAC,aAAa,CAAC;cAStB,OAAO,CAAC,aAAa,CAAC;EAgCzC"}