@opengeni/github 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,63 @@
+import { Settings } from '@opengeni/config';
+import { GitHubRepository } from '@opengeni/contracts';
+
+declare const stateMaxAgeSeconds: number;
+declare class GitHubAppConfigurationError extends Error {
+    readonly missing: string[];
+    constructor(missing: string[]);
+}
+declare class GitHubAppApiError extends Error {
+}
+type GitHubAppInstallationSummary = {
+    installationId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+    suspended: boolean;
+};
+type GitHubSignedStatePayload = {
+    nonce: string;
+    iat: number;
+    accountId?: string;
+    workspaceId?: string;
+    [key: string]: unknown;
+};
+declare function githubAppMissingSettings(settings: Settings): string[];
+declare function buildGitHubAppManifest(input: {
+    appName: string;
+    baseUrl: string;
+    public: boolean;
+    includeCiPermissions: boolean;
+    setupUrl?: string;
+}): Record<string, unknown>;
+declare function personalAppManifestUrl(state: string): string;
+declare function organizationAppManifestUrl(organization: string, state: string): string;
+declare function githubOAuthAuthorizeUrl(input: {
+    clientId: string;
+    state: string;
+    redirectUri?: string;
+}): string;
+declare function createSignedState(secret: string, payloadOrNow?: Record<string, unknown> | number, nowArg?: number): string;
+declare function readSignedState(state: string, secret: string, now?: number): GitHubSignedStatePayload | null;
+declare function verifySignedState(state: string, secret: string, now?: number): boolean;
+declare function envLinesFromGitHubManifestConversion(payload: Record<string, unknown>): string[];
+declare function convertGitHubAppManifest(code: string): Promise<Record<string, unknown>>;
+declare function listGitHubAppInstallationSummaries(settings: Settings): Promise<GitHubAppInstallationSummary[]>;
+declare function getGitHubAppInstallationSummary(settings: Settings, installationId: number): Promise<GitHubAppInstallationSummary | null>;
+declare function verifyGitHubInstallationAccessForUser(settings: Settings, input: {
+    code: string;
+    installationId: number;
+}): Promise<GitHubAppInstallationSummary>;
+declare function listGitHubAppRepositories(settings: Settings, input?: {
+    installationIds?: number[];
+}): Promise<GitHubRepository[]>;
+declare function createGitHubAppInstallationToken(settings: Settings, input: {
+    installationId: number;
+    repositoryIds?: number[];
+}): Promise<string>;
+declare function githubAppBotIdentity(settings: Settings): {
+    name: string;
+    email: string;
+} | null;
+declare function normalizeGitHubAppPrivateKey(value: string): string;
+
+export { GitHubAppApiError, GitHubAppConfigurationError, type GitHubAppInstallationSummary, type GitHubSignedStatePayload, buildGitHubAppManifest, convertGitHubAppManifest, createGitHubAppInstallationToken, createSignedState, envLinesFromGitHubManifestConversion, getGitHubAppInstallationSummary, githubAppBotIdentity, githubAppMissingSettings, githubOAuthAuthorizeUrl, listGitHubAppInstallationSummaries, listGitHubAppRepositories, normalizeGitHubAppPrivateKey, organizationAppManifestUrl, personalAppManifestUrl, readSignedState, stateMaxAgeSeconds, verifyGitHubInstallationAccessForUser, verifySignedState };

package/dist/index.js

@@ -0,0 +1,408 @@
+// src/index.ts
+import { createHmac, createPrivateKey, randomBytes, timingSafeEqual } from "crypto";
+import { SignJWT, importPKCS8 } from "jose";
+var githubApiBase = "https://api.github.com";
+var githubApiVersion = "2022-11-28";
+var stateMaxAgeSeconds = 60 * 60;
+var pkcs8PrivateKeyHeader = `-----BEGIN ${"PRIVATE KEY"}-----`;
+var rsaPrivateKeyHeader = `-----BEGIN ${"RSA PRIVATE KEY"}-----`;
+var GitHubAppConfigurationError = class extends Error {
+  constructor(missing) {
+    super("GitHub App is not configured");
+    this.missing = missing;
+  }
+  missing;
+};
+var GitHubAppApiError = class extends Error {
+};
+function githubAppMissingSettings(settings) {
+  const required = {
+    OPENGENI_GITHUB_APP_ID: settings.githubAppId,
+    OPENGENI_GITHUB_CLIENT_ID: settings.githubClientId,
+    OPENGENI_GITHUB_CLIENT_SECRET: settings.githubClientSecret,
+    OPENGENI_GITHUB_APP_SLUG: settings.githubAppSlug,
+    OPENGENI_GITHUB_APP_PRIVATE_KEY: settings.githubAppPrivateKey
+  };
+  return Object.entries(required).flatMap(([name, value]) => value && value.trim() ? [] : [name]);
+}
+function buildGitHubAppManifest(input) {
+  const base = input.baseUrl.replace(/\/+$/, "");
+  const permissions = {
+    metadata: "read",
+    contents: "write",
+    pull_requests: "write"
+  };
+  if (input.includeCiPermissions) {
+    permissions.actions = "read";
+    permissions.checks = "read";
+    permissions.statuses = "write";
+  }
+  const manifest = {
+    name: input.appName,
+    url: base,
+    redirect_url: `${base}/v1/github/app-manifest/callback`,
+    public: input.public,
+    request_oauth_on_install: true,
+    default_permissions: permissions
+  };
+  if (input.setupUrl) {
+    manifest.setup_url = input.setupUrl;
+    manifest.setup_on_update = true;
+  }
+  return manifest;
+}
+function personalAppManifestUrl(state) {
+  return `https://github.com/settings/apps/new?state=${state}`;
+}
+function organizationAppManifestUrl(organization, state) {
+  return `https://github.com/organizations/${encodeURIComponent(organization)}/settings/apps/new?state=${state}`;
+}
+function githubOAuthAuthorizeUrl(input) {
+  const url = new URL("https://github.com/login/oauth/authorize");
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("state", input.state);
+  if (input.redirectUri) {
+    url.searchParams.set("redirect_uri", input.redirectUri);
+  }
+  return url.toString();
+}
+function createSignedState(secret, payloadOrNow = {}, nowArg = Math.floor(Date.now() / 1e3)) {
+  const payloadInput = typeof payloadOrNow === "number" ? {} : payloadOrNow;
+  const now = typeof payloadOrNow === "number" ? payloadOrNow : nowArg;
+  const payload = {
+    ...payloadInput,
+    nonce: randomBytes(16).toString("base64url"),
+    iat: now
+  };
+  const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `${encoded}.${signStatePayload(encoded, secret)}`;
+}
+function readSignedState(state, secret, now = Math.floor(Date.now() / 1e3)) {
+  const [encoded, signature] = state.split(".", 2);
+  if (!encoded || !signature) {
+    return null;
+  }
+  const expected = signStatePayload(encoded, secret);
+  if (!safeEqual(signature, expected)) {
+    return null;
+  }
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload !== "object" || typeof payload.iat !== "number" || typeof payload.nonce !== "string") {
+    return null;
+  }
+  const age = now - payload.iat;
+  return age >= 0 && age <= stateMaxAgeSeconds ? payload : null;
+}
+function verifySignedState(state, secret, now = Math.floor(Date.now() / 1e3)) {
+  return readSignedState(state, secret, now) !== null;
+}
+function envLinesFromGitHubManifestConversion(payload) {
+  const privateKey = String(payload.pem ?? "").replace(/\n/g, "\\n");
+  return [
+    `OPENGENI_GITHUB_APP_ID=${payload.id ?? ""}`,
+    `OPENGENI_GITHUB_CLIENT_ID=${payload.client_id ?? ""}`,
+    `OPENGENI_GITHUB_CLIENT_SECRET=${payload.client_secret ?? ""}`,
+    `OPENGENI_GITHUB_APP_SLUG=${payload.slug ?? ""}`,
+    `OPENGENI_GITHUB_WEBHOOK_SECRET=${payload.webhook_secret ?? ""}`,
+    `OPENGENI_GITHUB_APP_PRIVATE_KEY="${privateKey}"`
+  ];
+}
+async function convertGitHubAppManifest(code) {
+  const response = await fetch(`${githubApiBase}/app-manifests/${code}/conversions`, {
+    method: "POST",
+    headers: githubHeaders(void 0)
+  });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  const payload = await response.json();
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new GitHubAppApiError("GitHub returned an invalid manifest conversion payload");
+  }
+  return payload;
+}
+async function listGitHubAppInstallationSummaries(settings) {
+  const missing = githubAppMissingSettings(settings);
+  if (missing.length > 0) {
+    throw new GitHubAppConfigurationError(missing);
+  }
+  const jwt = await createGitHubAppJwt(settings);
+  const installations = await listInstallations(jwt);
+  return installations.map(installationSummaryFromPayload);
+}
+async function getGitHubAppInstallationSummary(settings, installationId) {
+  const installations = await listGitHubAppInstallationSummaries(settings);
+  return installations.find((installation) => installation.installationId === installationId) ?? null;
+}
+async function verifyGitHubInstallationAccessForUser(settings, input) {
+  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);
+  const installations = await listUserAccessibleInstallations(token);
+  const installation = installations.find((candidate) => candidate.installationId === input.installationId);
+  if (!installation) {
+    throw new GitHubAppApiError("GitHub installation is not accessible to the installing user");
+  }
+  return installation;
+}
+async function listGitHubAppRepositories(settings, input = {}) {
+  const missing = githubAppMissingSettings(settings);
+  if (missing.length > 0) {
+    throw new GitHubAppConfigurationError(missing);
+  }
+  const allowedInstallations = input.installationIds ? new Set(input.installationIds) : null;
+  if (allowedInstallations && allowedInstallations.size === 0) {
+    return [];
+  }
+  const jwt = await createGitHubAppJwt(settings);
+  const installations = await listInstallations(jwt);
+  const repositories = [];
+  for (const installation of installations) {
+    if (installation.suspended_at) {
+      continue;
+    }
+    const installationId = asInt(installation.id);
+    if (installationId === null) {
+      continue;
+    }
+    if (allowedInstallations && !allowedInstallations.has(installationId)) {
+      continue;
+    }
+    const account = typeof installation.account === "object" && installation.account ? installation.account : {};
+    const token = await createInstallationToken(jwt, { installationId });
+    repositories.push(...await listInstallationRepositories(token, installationId, account));
+  }
+  repositories.sort((left, right) => left.fullName.localeCompare(right.fullName));
+  return repositories;
+}
+async function createGitHubAppInstallationToken(settings, input) {
+  const missing = githubAppMissingSettings(settings);
+  if (missing.length > 0) {
+    throw new GitHubAppConfigurationError(missing);
+  }
+  const jwt = await createGitHubAppJwt(settings);
+  return await createInstallationToken(jwt, input);
+}
+function githubAppBotIdentity(settings) {
+  const appId = settings.githubAppId?.trim();
+  const slug = settings.githubAppSlug?.trim();
+  if (!appId || !slug) {
+    return null;
+  }
+  const login = `${slug}[bot]`;
+  return {
+    name: login,
+    email: `${appId}+${login}@users.noreply.github.com`
+  };
+}
+async function createGitHubAppJwt(settings) {
+  const privateKey = normalizeGitHubAppPrivateKey(settings.githubAppPrivateKey ?? "");
+  const appId = settings.githubAppId?.trim();
+  if (!appId || !privateKey) {
+    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));
+  }
+  const key = await importPKCS8(privateKey, "RS256");
+  const now = Math.floor(Date.now() / 1e3);
+  return await new SignJWT({}).setProtectedHeader({ alg: "RS256" }).setIssuedAt(now - 60).setExpirationTime(now + 9 * 60).setIssuer(appId).sign(key);
+}
+async function listInstallations(token) {
+  const out = [];
+  for (let page = 1; ; page += 1) {
+    const payload = await githubGet("/app/installations", token, { per_page: "100", page: String(page) });
+    if (!Array.isArray(payload)) {
+      throw new GitHubAppApiError("GitHub returned an invalid installations payload");
+    }
+    out.push(...payload.filter((item) => Boolean(item && typeof item === "object" && !Array.isArray(item))));
+    if (payload.length < 100) {
+      return out;
+    }
+  }
+}
+async function exchangeGitHubOAuthCodeForUserToken(settings, code) {
+  if (!settings.githubClientId || !settings.githubClientSecret) {
+    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));
+  }
+  const response = await fetch("https://github.com/login/oauth/access_token", {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      client_id: settings.githubClientId,
+      client_secret: settings.githubClientSecret,
+      code
+    })
+  });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  const payload = await response.json();
+  if (!payload || typeof payload !== "object" || typeof payload.access_token !== "string") {
+    throw new GitHubAppApiError("GitHub returned an invalid OAuth token payload");
+  }
+  return payload.access_token;
+}
+async function listUserAccessibleInstallations(token) {
+  const out = [];
+  for (let page = 1; ; page += 1) {
+    const payload = await githubGet("/user/installations", token, { per_page: "100", page: String(page) });
+    const installations = payload && typeof payload === "object" && Array.isArray(payload.installations) ? payload.installations : null;
+    if (!installations) {
+      throw new GitHubAppApiError("GitHub returned an invalid user installations payload");
+    }
+    out.push(...installations.filter((item) => Boolean(item && typeof item === "object" && !Array.isArray(item))).map(installationSummaryFromPayload));
+    if (installations.length < 100) {
+      return out;
+    }
+  }
+}
+async function createInstallationToken(appJwt, input) {
+  const scoped = input.repositoryIds && input.repositoryIds.length > 0;
+  const response = await fetch(`${githubApiBase}/app/installations/${input.installationId}/access_tokens`, {
+    method: "POST",
+    headers: {
+      ...githubHeaders(appJwt),
+      ...scoped ? { "Content-Type": "application/json" } : {}
+    },
+    ...scoped ? { body: JSON.stringify({ repository_ids: input.repositoryIds }) } : {}
+  });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  const payload = await response.json();
+  if (!payload || typeof payload !== "object" || typeof payload.token !== "string") {
+    throw new GitHubAppApiError("GitHub returned an invalid installation token payload");
+  }
+  return payload.token;
+}
+async function listInstallationRepositories(token, installationId, account) {
+  const out = [];
+  for (let page = 1; ; page += 1) {
+    const payload = await githubGet("/installation/repositories", token, { per_page: "100", page: String(page) });
+    if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Array.isArray(payload.repositories)) {
+      throw new GitHubAppApiError("GitHub returned an invalid repositories payload");
+    }
+    for (const repo of payload.repositories) {
+      if (repo && typeof repo === "object" && !Array.isArray(repo)) {
+        out.push(repositoryFromPayload(repo, installationId, account));
+      }
+    }
+    if (payload.repositories.length < 100) {
+      return out;
+    }
+  }
+}
+function installationSummaryFromPayload(payload) {
+  const installationId = asInt(payload.id);
+  if (installationId === null) {
+    throw new GitHubAppApiError("GitHub returned an installation without id");
+  }
+  const account = typeof payload.account === "object" && payload.account ? payload.account : {};
+  return {
+    installationId,
+    accountLogin: typeof account.login === "string" ? account.login : null,
+    accountType: typeof account.type === "string" ? account.type : null,
+    suspended: Boolean(payload.suspended_at)
+  };
+}
+async function githubGet(path, token, params) {
+  const url = new URL(`${githubApiBase}${path}`);
+  for (const [key, value] of Object.entries(params)) {
+    url.searchParams.set(key, value);
+  }
+  const response = await fetch(url, { headers: githubHeaders(token) });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  return await response.json();
+}
+function repositoryFromPayload(payload, installationId, account) {
+  const id = asInt(payload.id);
+  const fullName = String(payload.full_name ?? "");
+  if (id === null || !fullName) {
+    throw new GitHubAppApiError("GitHub returned a repository without id/full_name");
+  }
+  return {
+    id,
+    installationId,
+    fullName,
+    name: String(payload.name ?? fullName.split("/").at(-1) ?? fullName),
+    private: Boolean(payload.private),
+    htmlUrl: String(payload.html_url ?? `https://github.com/${fullName}`),
+    cloneUrl: String(payload.clone_url ?? `https://github.com/${fullName}.git`),
+    defaultBranch: String(payload.default_branch ?? "main"),
+    accountLogin: String(account.login ?? fullName.split("/", 1)[0]),
+    accountType: typeof account.type === "string" ? account.type : null
+  };
+}
+function githubHeaders(token) {
+  return {
+    Accept: "application/vnd.github+json",
+    ...token ? { Authorization: `Bearer ${token}` } : {},
+    "X-GitHub-Api-Version": githubApiVersion
+  };
+}
+async function githubErrorMessage(response) {
+  try {
+    const payload = await response.json();
+    if (payload && typeof payload === "object" && "message" in payload) {
+      return `GitHub API ${response.status}: ${String(payload.message)}`;
+    }
+  } catch {
+  }
+  return `GitHub API ${response.status}: ${await response.text()}`;
+}
+function normalizeGitHubAppPrivateKey(value) {
+  const privateKey = value.trim().replace(/\\n/g, "\n");
+  if (!privateKey || privateKey.startsWith(pkcs8PrivateKeyHeader)) {
+    return privateKey;
+  }
+  if (privateKey.startsWith(rsaPrivateKeyHeader)) {
+    return createPrivateKey(privateKey).export({ type: "pkcs8", format: "pem" }).toString();
+  }
+  return privateKey;
+}
+function signStatePayload(encoded, secret) {
+  return createHmac("sha256", secret).update(encoded).digest("base64url");
+}
+function safeEqual(left, right) {
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function asInt(value) {
+  if (typeof value === "number" && Number.isInteger(value)) {
+    return value;
+  }
+  if (typeof value === "string" && /^\d+$/.test(value)) {
+    return Number(value);
+  }
+  return null;
+}
+export {
+  GitHubAppApiError,
+  GitHubAppConfigurationError,
+  buildGitHubAppManifest,
+  convertGitHubAppManifest,
+  createGitHubAppInstallationToken,
+  createSignedState,
+  envLinesFromGitHubManifestConversion,
+  getGitHubAppInstallationSummary,
+  githubAppBotIdentity,
+  githubAppMissingSettings,
+  githubOAuthAuthorizeUrl,
+  listGitHubAppInstallationSummaries,
+  listGitHubAppRepositories,
+  normalizeGitHubAppPrivateKey,
+  organizationAppManifestUrl,
+  personalAppManifestUrl,
+  readSignedState,
+  stateMaxAgeSeconds,
+  verifyGitHubInstallationAccessForUser,
+  verifySignedState
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type { GitHubRepository } from \"@opengeni/contracts\";\nimport { createHmac, createPrivateKey, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { SignJWT, importPKCS8 } from \"jose\";\n\nconst githubApiBase = \"https://api.github.com\";\nconst githubApiVersion = \"2022-11-28\";\nexport const stateMaxAgeSeconds = 60 * 60;\nconst pkcs8PrivateKeyHeader = `-----BEGIN ${\"PRIVATE KEY\"}-----`;\nconst rsaPrivateKeyHeader = `-----BEGIN ${\"RSA PRIVATE KEY\"}-----`;\n\nexport class GitHubAppConfigurationError extends Error {\n  constructor(readonly missing: string[]) {\n    super(\"GitHub App is not configured\");\n  }\n}\n\nexport class GitHubAppApiError extends Error {}\n\nexport type GitHubAppInstallationSummary = {\n  installationId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubSignedStatePayload = {\n  nonce: string;\n  iat: number;\n  accountId?: string;\n  workspaceId?: string;\n  [key: string]: unknown;\n};\n\nexport function githubAppMissingSettings(settings: Settings): string[] {\n  const required: Record<string, string | undefined> = {\n    OPENGENI_GITHUB_APP_ID: settings.githubAppId,\n    OPENGENI_GITHUB_CLIENT_ID: settings.githubClientId,\n    OPENGENI_GITHUB_CLIENT_SECRET: settings.githubClientSecret,\n    OPENGENI_GITHUB_APP_SLUG: settings.githubAppSlug,\n    OPENGENI_GITHUB_APP_PRIVATE_KEY: settings.githubAppPrivateKey,\n  };\n  return Object.entries(required).flatMap(([name, value]) => value && value.trim() ? [] : [name]);\n}\n\nexport function buildGitHubAppManifest(input: {\n  appName: string;\n  baseUrl: string;\n  public: boolean;\n  includeCiPermissions: boolean;\n  setupUrl?: string;\n}): Record<string, unknown> {\n  const base = input.baseUrl.replace(/\\/+$/, \"\");\n  const permissions: Record<string, string> = {\n    metadata: \"read\",\n    contents: \"write\",\n    pull_requests: \"write\",\n  };\n  if (input.includeCiPermissions) {\n    permissions.actions = \"read\";\n    permissions.checks = \"read\";\n    permissions.statuses = \"write\";\n  }\n  const manifest: Record<string, unknown> = {\n    name: input.appName,\n    url: base,\n    redirect_url: `${base}/v1/github/app-manifest/callback`,\n    public: input.public,\n    request_oauth_on_install: true,\n    default_permissions: permissions,\n  };\n  if (input.setupUrl) {\n    manifest.setup_url = input.setupUrl;\n    manifest.setup_on_update = true;\n  }\n  return manifest;\n}\n\nexport function personalAppManifestUrl(state: string): string {\n  return `https://github.com/settings/apps/new?state=${state}`;\n}\n\nexport function organizationAppManifestUrl(organization: string, state: string): string {\n  return `https://github.com/organizations/${encodeURIComponent(organization)}/settings/apps/new?state=${state}`;\n}\n\nexport function githubOAuthAuthorizeUrl(input: {\n  clientId: string;\n  state: string;\n  redirectUri?: string;\n}): string {\n  const url = new URL(\"https://github.com/login/oauth/authorize\");\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"state\", input.state);\n  if (input.redirectUri) {\n    url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  }\n  return url.toString();\n}\n\nexport function createSignedState(\n  secret: string,\n  payloadOrNow: Record<string, unknown> | number = {},\n  nowArg = Math.floor(Date.now() / 1000),\n): string {\n  const payloadInput = typeof payloadOrNow === \"number\" ? {} : payloadOrNow;\n  const now = typeof payloadOrNow === \"number\" ? payloadOrNow : nowArg;\n  const payload = {\n    ...payloadInput,\n    nonce: randomBytes(16).toString(\"base64url\"),\n    iat: now,\n  };\n  const encoded = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  return `${encoded}.${signStatePayload(encoded, secret)}`;\n}\n\nexport function readSignedState(state: string, secret: string, now = Math.floor(Date.now() / 1000)): GitHubSignedStatePayload | null {\n  const [encoded, signature] = state.split(\".\", 2);\n  if (!encoded || !signature) {\n    return null;\n  }\n  const expected = signStatePayload(encoded, secret);\n  if (!safeEqual(signature, expected)) {\n    return null;\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return null;\n  }\n  if (!payload || typeof payload !== \"object\" || typeof (payload as { iat?: unknown }).iat !== \"number\" || typeof (payload as { nonce?: unknown }).nonce !== \"string\") {\n    return null;\n  }\n  const age = now - (payload as { iat: number }).iat;\n  return age >= 0 && age <= stateMaxAgeSeconds ? payload as GitHubSignedStatePayload : null;\n}\n\nexport function verifySignedState(state: string, secret: string, now = Math.floor(Date.now() / 1000)): boolean {\n  return readSignedState(state, secret, now) !== null;\n}\n\nexport function envLinesFromGitHubManifestConversion(payload: Record<string, unknown>): string[] {\n  const privateKey = String(payload.pem ?? \"\").replace(/\\n/g, \"\\\\n\");\n  return [\n    `OPENGENI_GITHUB_APP_ID=${payload.id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_ID=${payload.client_id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_SECRET=${payload.client_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_SLUG=${payload.slug ?? \"\"}`,\n    `OPENGENI_GITHUB_WEBHOOK_SECRET=${payload.webhook_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_PRIVATE_KEY=\"${privateKey}\"`,\n  ];\n}\n\nexport async function convertGitHubAppManifest(code: string): Promise<Record<string, unknown>> {\n  const response = await fetch(`${githubApiBase}/app-manifests/${code}/conversions`, {\n    method: \"POST\",\n    headers: githubHeaders(undefined),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || Array.isArray(payload)) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid manifest conversion payload\");\n  }\n  return payload as Record<string, unknown>;\n}\n\nexport async function listGitHubAppInstallationSummaries(settings: Settings): Promise<GitHubAppInstallationSummary[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  return installations.map(installationSummaryFromPayload);\n}\n\nexport async function getGitHubAppInstallationSummary(settings: Settings, installationId: number): Promise<GitHubAppInstallationSummary | null> {\n  const installations = await listGitHubAppInstallationSummaries(settings);\n  return installations.find((installation) => installation.installationId === installationId) ?? null;\n}\n\nexport async function verifyGitHubInstallationAccessForUser(settings: Settings, input: {\n  code: string;\n  installationId: number;\n}): Promise<GitHubAppInstallationSummary> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  const installation = installations.find((candidate) => candidate.installationId === input.installationId);\n  if (!installation) {\n    throw new GitHubAppApiError(\"GitHub installation is not accessible to the installing user\");\n  }\n  return installation;\n}\n\nexport async function listGitHubAppRepositories(settings: Settings, input: {\n  installationIds?: number[];\n} = {}): Promise<GitHubRepository[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const allowedInstallations = input.installationIds ? new Set(input.installationIds) : null;\n  if (allowedInstallations && allowedInstallations.size === 0) {\n    return [];\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  const repositories: GitHubRepository[] = [];\n  for (const installation of installations) {\n    if (installation.suspended_at) {\n      continue;\n    }\n    const installationId = asInt(installation.id);\n    if (installationId === null) {\n      continue;\n    }\n    if (allowedInstallations && !allowedInstallations.has(installationId)) {\n      continue;\n    }\n    const account = typeof installation.account === \"object\" && installation.account ? installation.account as Record<string, unknown> : {};\n    const token = await createInstallationToken(jwt, { installationId });\n    repositories.push(...await listInstallationRepositories(token, installationId, account));\n  }\n  repositories.sort((left, right) => left.fullName.localeCompare(right.fullName));\n  return repositories;\n}\n\nexport async function createGitHubAppInstallationToken(settings: Settings, input: {\n  installationId: number;\n  repositoryIds?: number[];\n}): Promise<string> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  return await createInstallationToken(jwt, input);\n}\n\nexport function githubAppBotIdentity(settings: Settings): { name: string; email: string } | null {\n  const appId = settings.githubAppId?.trim();\n  const slug = settings.githubAppSlug?.trim();\n  if (!appId || !slug) {\n    return null;\n  }\n  const login = `${slug}[bot]`;\n  return {\n    name: login,\n    email: `${appId}+${login}@users.noreply.github.com`,\n  };\n}\n\nasync function createGitHubAppJwt(settings: Settings): Promise<string> {\n  const privateKey = normalizeGitHubAppPrivateKey(settings.githubAppPrivateKey ?? \"\");\n  const appId = settings.githubAppId?.trim();\n  if (!appId || !privateKey) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const key = await importPKCS8(privateKey, \"RS256\");\n  const now = Math.floor(Date.now() / 1000);\n  return await new SignJWT({})\n    .setProtectedHeader({ alg: \"RS256\" })\n    .setIssuedAt(now - 60)\n    .setExpirationTime(now + 9 * 60)\n    .setIssuer(appId)\n    .sign(key);\n}\n\nasync function listInstallations(token: string): Promise<Array<Record<string, unknown>>> {\n  const out: Array<Record<string, unknown>> = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/app/installations\", token, { per_page: \"100\", page: String(page) });\n    if (!Array.isArray(payload)) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid installations payload\");\n    }\n    out.push(...payload.filter((item): item is Record<string, unknown> => Boolean(item && typeof item === \"object\" && !Array.isArray(item))));\n    if (payload.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function exchangeGitHubOAuthCodeForUserToken(settings: Settings, code: string): Promise<string> {\n  if (!settings.githubClientId || !settings.githubClientSecret) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const response = await fetch(\"https://github.com/login/oauth/access_token\", {\n    method: \"POST\",\n    headers: {\n      Accept: \"application/json\",\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      client_id: settings.githubClientId,\n      client_secret: settings.githubClientSecret,\n      code,\n    }),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.access_token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid OAuth token payload\");\n  }\n  return payload.access_token;\n}\n\nasync function listUserAccessibleInstallations(token: string): Promise<GitHubAppInstallationSummary[]> {\n  const out: GitHubAppInstallationSummary[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/user/installations\", token, { per_page: \"100\", page: String(page) });\n    const installations: unknown[] | null = payload && typeof payload === \"object\" && Array.isArray(payload.installations)\n      ? payload.installations as unknown[]\n      : null;\n    if (!installations) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid user installations payload\");\n    }\n    out.push(...installations\n      .filter((item): item is Record<string, unknown> => Boolean(item && typeof item === \"object\" && !Array.isArray(item)))\n      .map(installationSummaryFromPayload));\n    if (installations.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function createInstallationToken(appJwt: string, input: {\n  installationId: number;\n  repositoryIds?: number[];\n}): Promise<string> {\n  const scoped = input.repositoryIds && input.repositoryIds.length > 0;\n  const response = await fetch(`${githubApiBase}/app/installations/${input.installationId}/access_tokens`, {\n    method: \"POST\",\n    headers: {\n      ...githubHeaders(appJwt),\n      ...(scoped ? { \"Content-Type\": \"application/json\" } : {}),\n    },\n    ...(scoped ? { body: JSON.stringify({ repository_ids: input.repositoryIds }) } : {}),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid installation token payload\");\n  }\n  return payload.token;\n}\n\nasync function listInstallationRepositories(token: string, installationId: number, account: Record<string, unknown>): Promise<GitHubRepository[]> {\n  const out: GitHubRepository[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/installation/repositories\", token, { per_page: \"100\", page: String(page) });\n    if (!payload || typeof payload !== \"object\" || Array.isArray(payload) || !Array.isArray(payload.repositories)) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid repositories payload\");\n    }\n    for (const repo of payload.repositories) {\n      if (repo && typeof repo === \"object\" && !Array.isArray(repo)) {\n        out.push(repositoryFromPayload(repo as Record<string, unknown>, installationId, account));\n      }\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nfunction installationSummaryFromPayload(payload: Record<string, unknown>): GitHubAppInstallationSummary {\n  const installationId = asInt(payload.id);\n  if (installationId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without id\");\n  }\n  const account = typeof payload.account === \"object\" && payload.account ? payload.account as Record<string, unknown> : {};\n  return {\n    installationId,\n    accountLogin: typeof account.login === \"string\" ? account.login : null,\n    accountType: typeof account.type === \"string\" ? account.type : null,\n    suspended: Boolean(payload.suspended_at),\n  };\n}\n\nasync function githubGet(path: string, token: string, params: Record<string, string>): Promise<any> {\n  const url = new URL(`${githubApiBase}${path}`);\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, value);\n  }\n  const response = await fetch(url, { headers: githubHeaders(token) });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  return await response.json();\n}\n\nfunction repositoryFromPayload(payload: Record<string, unknown>, installationId: number, account: Record<string, unknown>): GitHubRepository {\n  const id = asInt(payload.id);\n  const fullName = String(payload.full_name ?? \"\");\n  if (id === null || !fullName) {\n    throw new GitHubAppApiError(\"GitHub returned a repository without id/full_name\");\n  }\n  return {\n    id,\n    installationId,\n    fullName,\n    name: String(payload.name ?? fullName.split(\"/\").at(-1) ?? fullName),\n    private: Boolean(payload.private),\n    htmlUrl: String(payload.html_url ?? `https://github.com/${fullName}`),\n    cloneUrl: String(payload.clone_url ?? `https://github.com/${fullName}.git`),\n    defaultBranch: String(payload.default_branch ?? \"main\"),\n    accountLogin: String(account.login ?? fullName.split(\"/\", 1)[0]),\n    accountType: typeof account.type === \"string\" ? account.type : null,\n  };\n}\n\nfunction githubHeaders(token?: string): HeadersInit {\n  return {\n    Accept: \"application/vnd.github+json\",\n    ...(token ? { Authorization: `Bearer ${token}` } : {}),\n    \"X-GitHub-Api-Version\": githubApiVersion,\n  };\n}\n\nasync function githubErrorMessage(response: Response): Promise<string> {\n  try {\n    const payload = await response.json();\n    if (payload && typeof payload === \"object\" && \"message\" in payload) {\n      return `GitHub API ${response.status}: ${String(payload.message)}`;\n    }\n  } catch {\n    // fall through\n  }\n  return `GitHub API ${response.status}: ${await response.text()}`;\n}\n\nexport function normalizeGitHubAppPrivateKey(value: string): string {\n  const privateKey = value.trim().replace(/\\\\n/g, \"\\n\");\n  if (!privateKey || privateKey.startsWith(pkcs8PrivateKeyHeader)) {\n    return privateKey;\n  }\n  if (privateKey.startsWith(rsaPrivateKeyHeader)) {\n    return createPrivateKey(privateKey).export({ type: \"pkcs8\", format: \"pem\" }).toString();\n  }\n  return privateKey;\n}\n\nfunction signStatePayload(encoded: string, secret: string): string {\n  return createHmac(\"sha256\", secret).update(encoded).digest(\"base64url\");\n}\n\nfunction safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction asInt(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value)) {\n    return value;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) {\n    return Number(value);\n  }\n  return null;\n}\n"],"mappings":";AAEA,SAAS,YAAY,kBAAkB,aAAa,uBAAuB;AAC3E,SAAS,SAAS,mBAAmB;AAErC,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AAClB,IAAM,qBAAqB,KAAK;AACvC,IAAM,wBAAwB,cAAc,aAAa;AACzD,IAAM,sBAAsB,cAAc,iBAAiB;AAEpD,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAqB,SAAmB;AACtC,UAAM,8BAA8B;AADjB;AAAA,EAErB;AAAA,EAFqB;AAGvB;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAC;AAiBvC,SAAS,yBAAyB,UAA8B;AACrE,QAAM,WAA+C;AAAA,IACnD,wBAAwB,SAAS;AAAA,IACjC,2BAA2B,SAAS;AAAA,IACpC,+BAA+B,SAAS;AAAA,IACxC,0BAA0B,SAAS;AAAA,IACnC,iCAAiC,SAAS;AAAA,EAC5C;AACA,SAAO,OAAO,QAAQ,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAM,SAAS,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAChG;AAEO,SAAS,uBAAuB,OAMX;AAC1B,QAAM,OAAO,MAAM,QAAQ,QAAQ,QAAQ,EAAE;AAC7C,QAAM,cAAsC;AAAA,IAC1C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AACA,MAAI,MAAM,sBAAsB;AAC9B,gBAAY,UAAU;AACtB,gBAAY,SAAS;AACrB,gBAAY,WAAW;AAAA,EACzB;AACA,QAAM,WAAoC;AAAA,IACxC,MAAM,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,cAAc,GAAG,IAAI;AAAA,IACrB,QAAQ,MAAM;AAAA,IACd,0BAA0B;AAAA,IAC1B,qBAAqB;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,aAAS,YAAY,MAAM;AAC3B,aAAS,kBAAkB;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAuB;AAC5D,SAAO,8CAA8C,KAAK;AAC5D;AAEO,SAAS,2BAA2B,cAAsB,OAAuB;AACtF,SAAO,oCAAoC,mBAAmB,YAAY,CAAC,4BAA4B,KAAK;AAC9G;AAEO,SAAS,wBAAwB,OAI7B;AACT,QAAM,MAAM,IAAI,IAAI,0CAA0C;AAC9D,MAAI,aAAa,IAAI,aAAa,MAAM,QAAQ;AAChD,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,MAAI,MAAM,aAAa;AACrB,QAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;AAAA,EACxD;AACA,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,kBACd,QACA,eAAiD,CAAC,GAClD,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC7B;AACR,QAAM,eAAe,OAAO,iBAAiB,WAAW,CAAC,IAAI;AAC7D,QAAM,MAAM,OAAO,iBAAiB,WAAW,eAAe;AAC9D,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,IAC3C,KAAK;AAAA,EACP;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AACzE,SAAO,GAAG,OAAO,IAAI,iBAAiB,SAAS,MAAM,CAAC;AACxD;AAEO,SAAS,gBAAgB,OAAe,QAAgB,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAoC;AACnI,QAAM,CAAC,SAAS,SAAS,IAAI,MAAM,MAAM,KAAK,CAAC;AAC/C,MAAI,CAAC,WAAW,CAAC,WAAW;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,iBAAiB,SAAS,MAAM;AACjD,MAAI,CAAC,UAAU,WAAW,QAAQ,GAAG;AACnC,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAQ,QAA8B,QAAQ,YAAY,OAAQ,QAAgC,UAAU,UAAU;AACnK,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAO,QAA4B;AAC/C,SAAO,OAAO,KAAK,OAAO,qBAAqB,UAAsC;AACvF;AAEO,SAAS,kBAAkB,OAAe,QAAgB,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAY;AAC7G,SAAO,gBAAgB,OAAO,QAAQ,GAAG,MAAM;AACjD;AAEO,SAAS,qCAAqC,SAA4C;AAC/F,QAAM,aAAa,OAAO,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,KAAK;AACjE,SAAO;AAAA,IACL,0BAA0B,QAAQ,MAAM,EAAE;AAAA,IAC1C,6BAA6B,QAAQ,aAAa,EAAE;AAAA,IACpD,iCAAiC,QAAQ,iBAAiB,EAAE;AAAA,IAC5D,4BAA4B,QAAQ,QAAQ,EAAE;AAAA,IAC9C,kCAAkC,QAAQ,kBAAkB,EAAE;AAAA,IAC9D,oCAAoC,UAAU;AAAA,EAChD;AACF;AAEA,eAAsB,yBAAyB,MAAgD;AAC7F,QAAM,WAAW,MAAM,MAAM,GAAG,aAAa,kBAAkB,IAAI,gBAAgB;AAAA,IACjF,QAAQ;AAAA,IACR,SAAS,cAAc,MAAS;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,UAAM,IAAI,kBAAkB,wDAAwD;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,mCAAmC,UAA6D;AACpH,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,SAAO,cAAc,IAAI,8BAA8B;AACzD;AAEA,eAAsB,gCAAgC,UAAoB,gBAAsE;AAC9I,QAAM,gBAAgB,MAAM,mCAAmC,QAAQ;AACvE,SAAO,cAAc,KAAK,CAAC,iBAAiB,aAAa,mBAAmB,cAAc,KAAK;AACjG;AAEA,eAAsB,sCAAsC,UAAoB,OAGtC;AACxC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,QAAM,eAAe,cAAc,KAAK,CAAC,cAAc,UAAU,mBAAmB,MAAM,cAAc;AACxG,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,kBAAkB,8DAA8D;AAAA,EAC5F;AACA,SAAO;AACT;AAEA,eAAsB,0BAA0B,UAAoB,QAEhE,CAAC,GAAgC;AACnC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,uBAAuB,MAAM,kBAAkB,IAAI,IAAI,MAAM,eAAe,IAAI;AACtF,MAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC3D,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,QAAM,eAAmC,CAAC;AAC1C,aAAW,gBAAgB,eAAe;AACxC,QAAI,aAAa,cAAc;AAC7B;AAAA,IACF;AACA,UAAM,iBAAiB,MAAM,aAAa,EAAE;AAC5C,QAAI,mBAAmB,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,wBAAwB,CAAC,qBAAqB,IAAI,cAAc,GAAG;AACrE;AAAA,IACF;AACA,UAAM,UAAU,OAAO,aAAa,YAAY,YAAY,aAAa,UAAU,aAAa,UAAqC,CAAC;AACtI,UAAM,QAAQ,MAAM,wBAAwB,KAAK,EAAE,eAAe,CAAC;AACnE,iBAAa,KAAK,GAAG,MAAM,6BAA6B,OAAO,gBAAgB,OAAO,CAAC;AAAA,EACzF;AACA,eAAa,KAAK,CAAC,MAAM,UAAU,KAAK,SAAS,cAAc,MAAM,QAAQ,CAAC;AAC9E,SAAO;AACT;AAEA,eAAsB,iCAAiC,UAAoB,OAGvD;AAClB,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,SAAO,MAAM,wBAAwB,KAAK,KAAK;AACjD;AAEO,SAAS,qBAAqB,UAA4D;AAC/F,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,QAAM,OAAO,SAAS,eAAe,KAAK;AAC1C,MAAI,CAAC,SAAS,CAAC,MAAM;AACnB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,GAAG,IAAI;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,GAAG,KAAK,IAAI,KAAK;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,QAAM,aAAa,6BAA6B,SAAS,uBAAuB,EAAE;AAClF,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,MAAI,CAAC,SAAS,CAAC,YAAY;AACzB,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,MAAM,MAAM,YAAY,YAAY,OAAO;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,EACxB,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,MAAM,EAAE,EACpB,kBAAkB,MAAM,IAAI,EAAE,EAC9B,UAAU,KAAK,EACf,KAAK,GAAG;AACb;AAEA,eAAe,kBAAkB,OAAwD;AACvF,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,sBAAsB,OAAO,EAAE,UAAU,OAAO,MAAM,OAAO,IAAI,EAAE,CAAC;AACpG,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,YAAM,IAAI,kBAAkB,kDAAkD;AAAA,IAChF;AACA,QAAI,KAAK,GAAG,QAAQ,OAAO,CAAC,SAA0C,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC,CAAC,CAAC;AACxI,QAAI,QAAQ,SAAS,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,oCAAoC,UAAoB,MAA+B;AACpG,MAAI,CAAC,SAAS,kBAAkB,CAAC,SAAS,oBAAoB;AAC5D,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,WAAW,MAAM,MAAM,+CAA+C;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,eAAe,SAAS;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,iBAAiB,UAAU;AACvF,UAAM,IAAI,kBAAkB,gDAAgD;AAAA,EAC9E;AACA,SAAO,QAAQ;AACjB;AAEA,eAAe,gCAAgC,OAAwD;AACrG,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,uBAAuB,OAAO,EAAE,UAAU,OAAO,MAAM,OAAO,IAAI,EAAE,CAAC;AACrG,UAAM,gBAAkC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,QAAQ,aAAa,IACjH,QAAQ,gBACR;AACJ,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,kBAAkB,uDAAuD;AAAA,IACrF;AACA,QAAI,KAAK,GAAG,cACT,OAAO,CAAC,SAA0C,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC,CAAC,EACnH,IAAI,8BAA8B,CAAC;AACtC,QAAI,cAAc,SAAS,KAAK;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,QAAgB,OAGnC;AAClB,QAAM,SAAS,MAAM,iBAAiB,MAAM,cAAc,SAAS;AACnE,QAAM,WAAW,MAAM,MAAM,GAAG,aAAa,sBAAsB,MAAM,cAAc,kBAAkB;AAAA,IACvG,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,GAAG,cAAc,MAAM;AAAA,MACvB,GAAI,SAAS,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,IACzD;AAAA,IACA,GAAI,SAAS,EAAE,MAAM,KAAK,UAAU,EAAE,gBAAgB,MAAM,cAAc,CAAC,EAAE,IAAI,CAAC;AAAA,EACpF,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,UAAU;AAChF,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO,QAAQ;AACjB;AAEA,eAAe,6BAA6B,OAAe,gBAAwB,SAA+D;AAChJ,QAAM,MAA0B,CAAC;AACjC,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,8BAA8B,OAAO,EAAE,UAAU,OAAO,MAAM,OAAO,IAAI,EAAE,CAAC;AAC5G,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAC7G,YAAM,IAAI,kBAAkB,iDAAiD;AAAA,IAC/E;AACA,eAAW,QAAQ,QAAQ,cAAc;AACvC,UAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AAC5D,YAAI,KAAK,sBAAsB,MAAiC,gBAAgB,OAAO,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,+BAA+B,SAAgE;AACtG,QAAM,iBAAiB,MAAM,QAAQ,EAAE;AACvC,MAAI,mBAAmB,MAAM;AAC3B,UAAM,IAAI,kBAAkB,4CAA4C;AAAA,EAC1E;AACA,QAAM,UAAU,OAAO,QAAQ,YAAY,YAAY,QAAQ,UAAU,QAAQ,UAAqC,CAAC;AACvH,SAAO;AAAA,IACL;AAAA,IACA,cAAc,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAClE,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IAC/D,WAAW,QAAQ,QAAQ,YAAY;AAAA,EACzC;AACF;AAEA,eAAe,UAAU,MAAc,OAAe,QAA8C;AAClG,QAAM,MAAM,IAAI,IAAI,GAAG,aAAa,GAAG,IAAI,EAAE;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AACnE,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,SAAO,MAAM,SAAS,KAAK;AAC7B;AAEA,SAAS,sBAAsB,SAAkC,gBAAwB,SAAoD;AAC3I,QAAM,KAAK,MAAM,QAAQ,EAAE;AAC3B,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAC/C,MAAI,OAAO,QAAQ,CAAC,UAAU;AAC5B,UAAM,IAAI,kBAAkB,mDAAmD;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,QAAQ,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,QAAQ;AAAA,IACnE,SAAS,QAAQ,QAAQ,OAAO;AAAA,IAChC,SAAS,OAAO,QAAQ,YAAY,sBAAsB,QAAQ,EAAE;AAAA,IACpE,UAAU,OAAO,QAAQ,aAAa,sBAAsB,QAAQ,MAAM;AAAA,IAC1E,eAAe,OAAO,QAAQ,kBAAkB,MAAM;AAAA,IACtD,cAAc,OAAO,QAAQ,SAAS,SAAS,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,IAC/D,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,EACjE;AACF;AAEA,SAAS,cAAc,OAA6B;AAClD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,GAAI,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AAAA,IACpD,wBAAwB;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,MAAI;AACF,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,QAAI,WAAW,OAAO,YAAY,YAAY,aAAa,SAAS;AAClE,aAAO,cAAc,SAAS,MAAM,KAAK,OAAO,QAAQ,OAAO,CAAC;AAAA,IAClE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,cAAc,SAAS,MAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAChE;AAEO,SAAS,6BAA6B,OAAuB;AAClE,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,QAAQ,IAAI;AACpD,MAAI,CAAC,cAAc,WAAW,WAAW,qBAAqB,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,MAAI,WAAW,WAAW,mBAAmB,GAAG;AAC9C,WAAO,iBAAiB,UAAU,EAAE,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,QAAwB;AACjE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW;AACxE;AAEA,SAAS,UAAU,MAAc,OAAwB;AACvD,QAAM,IAAI,OAAO,KAAK,IAAI;AAC1B,QAAM,IAAI,OAAO,KAAK,KAAK;AAC3B,SAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAEA,SAAS,MAAM,OAA+B;AAC5C,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,GAAG;AACpD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@opengeni/github",
+  "version": "0.2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@opengeni/config": "^0.2.0",
+    "@opengeni/contracts": "^0.3.0",
+    "jose": "^6.1.3"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^6.0.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
+    "directory": "packages/github"
+  }
+}

package/src/index.ts

@@ -0,0 +1,467 @@
+import type { Settings } from "@opengeni/config";
+import type { GitHubRepository } from "@opengeni/contracts";
+import { createHmac, createPrivateKey, randomBytes, timingSafeEqual } from "node:crypto";
+import { SignJWT, importPKCS8 } from "jose";
+
+const githubApiBase = "https://api.github.com";
+const githubApiVersion = "2022-11-28";
+export const stateMaxAgeSeconds = 60 * 60;
+const pkcs8PrivateKeyHeader = `-----BEGIN ${"PRIVATE KEY"}-----`;
+const rsaPrivateKeyHeader = `-----BEGIN ${"RSA PRIVATE KEY"}-----`;
+
+export class GitHubAppConfigurationError extends Error {
+  constructor(readonly missing: string[]) {
+    super("GitHub App is not configured");
+  }
+}
+
+export class GitHubAppApiError extends Error {}
+
+export type GitHubAppInstallationSummary = {
+  installationId: number;
+  accountLogin: string | null;
+  accountType: string | null;
+  suspended: boolean;
+};
+
+export type GitHubSignedStatePayload = {
+  nonce: string;
+  iat: number;
+  accountId?: string;
+  workspaceId?: string;
+  [key: string]: unknown;
+};
+
+export function githubAppMissingSettings(settings: Settings): string[] {
+  const required: Record<string, string | undefined> = {
+    OPENGENI_GITHUB_APP_ID: settings.githubAppId,
+    OPENGENI_GITHUB_CLIENT_ID: settings.githubClientId,
+    OPENGENI_GITHUB_CLIENT_SECRET: settings.githubClientSecret,
+    OPENGENI_GITHUB_APP_SLUG: settings.githubAppSlug,
+    OPENGENI_GITHUB_APP_PRIVATE_KEY: settings.githubAppPrivateKey,
+  };
+  return Object.entries(required).flatMap(([name, value]) => value && value.trim() ? [] : [name]);
+}
+
+export function buildGitHubAppManifest(input: {
+  appName: string;
+  baseUrl: string;
+  public: boolean;
+  includeCiPermissions: boolean;
+  setupUrl?: string;
+}): Record<string, unknown> {
+  const base = input.baseUrl.replace(/\/+$/, "");
+  const permissions: Record<string, string> = {
+    metadata: "read",
+    contents: "write",
+    pull_requests: "write",
+  };
+  if (input.includeCiPermissions) {
+    permissions.actions = "read";
+    permissions.checks = "read";
+    permissions.statuses = "write";
+  }
+  const manifest: Record<string, unknown> = {
+    name: input.appName,
+    url: base,
+    redirect_url: `${base}/v1/github/app-manifest/callback`,
+    public: input.public,
+    request_oauth_on_install: true,
+    default_permissions: permissions,
+  };
+  if (input.setupUrl) {
+    manifest.setup_url = input.setupUrl;
+    manifest.setup_on_update = true;
+  }
+  return manifest;
+}
+
+export function personalAppManifestUrl(state: string): string {
+  return `https://github.com/settings/apps/new?state=${state}`;
+}
+
+export function organizationAppManifestUrl(organization: string, state: string): string {
+  return `https://github.com/organizations/${encodeURIComponent(organization)}/settings/apps/new?state=${state}`;
+}
+
+export function githubOAuthAuthorizeUrl(input: {
+  clientId: string;
+  state: string;
+  redirectUri?: string;
+}): string {
+  const url = new URL("https://github.com/login/oauth/authorize");
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("state", input.state);
+  if (input.redirectUri) {
+    url.searchParams.set("redirect_uri", input.redirectUri);
+  }
+  return url.toString();
+}
+
+export function createSignedState(
+  secret: string,
+  payloadOrNow: Record<string, unknown> | number = {},
+  nowArg = Math.floor(Date.now() / 1000),
+): string {
+  const payloadInput = typeof payloadOrNow === "number" ? {} : payloadOrNow;
+  const now = typeof payloadOrNow === "number" ? payloadOrNow : nowArg;
+  const payload = {
+    ...payloadInput,
+    nonce: randomBytes(16).toString("base64url"),
+    iat: now,
+  };
+  const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `${encoded}.${signStatePayload(encoded, secret)}`;
+}
+
+export function readSignedState(state: string, secret: string, now = Math.floor(Date.now() / 1000)): GitHubSignedStatePayload | null {
+  const [encoded, signature] = state.split(".", 2);
+  if (!encoded || !signature) {
+    return null;
+  }
+  const expected = signStatePayload(encoded, secret);
+  if (!safeEqual(signature, expected)) {
+    return null;
+  }
+  let payload: unknown;
+  try {
+    payload = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload !== "object" || typeof (payload as { iat?: unknown }).iat !== "number" || typeof (payload as { nonce?: unknown }).nonce !== "string") {
+    return null;
+  }
+  const age = now - (payload as { iat: number }).iat;
+  return age >= 0 && age <= stateMaxAgeSeconds ? payload as GitHubSignedStatePayload : null;
+}
+
+export function verifySignedState(state: string, secret: string, now = Math.floor(Date.now() / 1000)): boolean {
+  return readSignedState(state, secret, now) !== null;
+}
+
+export function envLinesFromGitHubManifestConversion(payload: Record<string, unknown>): string[] {
+  const privateKey = String(payload.pem ?? "").replace(/\n/g, "\\n");
+  return [
+    `OPENGENI_GITHUB_APP_ID=${payload.id ?? ""}`,
+    `OPENGENI_GITHUB_CLIENT_ID=${payload.client_id ?? ""}`,
+    `OPENGENI_GITHUB_CLIENT_SECRET=${payload.client_secret ?? ""}`,
+    `OPENGENI_GITHUB_APP_SLUG=${payload.slug ?? ""}`,
+    `OPENGENI_GITHUB_WEBHOOK_SECRET=${payload.webhook_secret ?? ""}`,
+    `OPENGENI_GITHUB_APP_PRIVATE_KEY="${privateKey}"`,
+  ];
+}
+
+export async function convertGitHubAppManifest(code: string): Promise<Record<string, unknown>> {
+  const response = await fetch(`${githubApiBase}/app-manifests/${code}/conversions`, {
+    method: "POST",
+    headers: githubHeaders(undefined),
+  });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  const payload = await response.json();
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new GitHubAppApiError("GitHub returned an invalid manifest conversion payload");
+  }
+  return payload as Record<string, unknown>;
+}
+
+export async function listGitHubAppInstallationSummaries(settings: Settings): Promise<GitHubAppInstallationSummary[]> {
+  const missing = githubAppMissingSettings(settings);
+  if (missing.length > 0) {
+    throw new GitHubAppConfigurationError(missing);
+  }
+  const jwt = await createGitHubAppJwt(settings);
+  const installations = await listInstallations(jwt);
+  return installations.map(installationSummaryFromPayload);
+}
+
+export async function getGitHubAppInstallationSummary(settings: Settings, installationId: number): Promise<GitHubAppInstallationSummary | null> {
+  const installations = await listGitHubAppInstallationSummaries(settings);
+  return installations.find((installation) => installation.installationId === installationId) ?? null;
+}
+
+export async function verifyGitHubInstallationAccessForUser(settings: Settings, input: {
+  code: string;
+  installationId: number;
+}): Promise<GitHubAppInstallationSummary> {
+  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);
+  const installations = await listUserAccessibleInstallations(token);
+  const installation = installations.find((candidate) => candidate.installationId === input.installationId);
+  if (!installation) {
+    throw new GitHubAppApiError("GitHub installation is not accessible to the installing user");
+  }
+  return installation;
+}
+
+export async function listGitHubAppRepositories(settings: Settings, input: {
+  installationIds?: number[];
+} = {}): Promise<GitHubRepository[]> {
+  const missing = githubAppMissingSettings(settings);
+  if (missing.length > 0) {
+    throw new GitHubAppConfigurationError(missing);
+  }
+  const allowedInstallations = input.installationIds ? new Set(input.installationIds) : null;
+  if (allowedInstallations && allowedInstallations.size === 0) {
+    return [];
+  }
+  const jwt = await createGitHubAppJwt(settings);
+  const installations = await listInstallations(jwt);
+  const repositories: GitHubRepository[] = [];
+  for (const installation of installations) {
+    if (installation.suspended_at) {
+      continue;
+    }
+    const installationId = asInt(installation.id);
+    if (installationId === null) {
+      continue;
+    }
+    if (allowedInstallations && !allowedInstallations.has(installationId)) {
+      continue;
+    }
+    const account = typeof installation.account === "object" && installation.account ? installation.account as Record<string, unknown> : {};
+    const token = await createInstallationToken(jwt, { installationId });
+    repositories.push(...await listInstallationRepositories(token, installationId, account));
+  }
+  repositories.sort((left, right) => left.fullName.localeCompare(right.fullName));
+  return repositories;
+}
+
+export async function createGitHubAppInstallationToken(settings: Settings, input: {
+  installationId: number;
+  repositoryIds?: number[];
+}): Promise<string> {
+  const missing = githubAppMissingSettings(settings);
+  if (missing.length > 0) {
+    throw new GitHubAppConfigurationError(missing);
+  }
+  const jwt = await createGitHubAppJwt(settings);
+  return await createInstallationToken(jwt, input);
+}
+
+export function githubAppBotIdentity(settings: Settings): { name: string; email: string } | null {
+  const appId = settings.githubAppId?.trim();
+  const slug = settings.githubAppSlug?.trim();
+  if (!appId || !slug) {
+    return null;
+  }
+  const login = `${slug}[bot]`;
+  return {
+    name: login,
+    email: `${appId}+${login}@users.noreply.github.com`,
+  };
+}
+
+async function createGitHubAppJwt(settings: Settings): Promise<string> {
+  const privateKey = normalizeGitHubAppPrivateKey(settings.githubAppPrivateKey ?? "");
+  const appId = settings.githubAppId?.trim();
+  if (!appId || !privateKey) {
+    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));
+  }
+  const key = await importPKCS8(privateKey, "RS256");
+  const now = Math.floor(Date.now() / 1000);
+  return await new SignJWT({})
+    .setProtectedHeader({ alg: "RS256" })
+    .setIssuedAt(now - 60)
+    .setExpirationTime(now + 9 * 60)
+    .setIssuer(appId)
+    .sign(key);
+}
+
+async function listInstallations(token: string): Promise<Array<Record<string, unknown>>> {
+  const out: Array<Record<string, unknown>> = [];
+  for (let page = 1; ; page += 1) {
+    const payload = await githubGet("/app/installations", token, { per_page: "100", page: String(page) });
+    if (!Array.isArray(payload)) {
+      throw new GitHubAppApiError("GitHub returned an invalid installations payload");
+    }
+    out.push(...payload.filter((item): item is Record<string, unknown> => Boolean(item && typeof item === "object" && !Array.isArray(item))));
+    if (payload.length < 100) {
+      return out;
+    }
+  }
+}
+
+async function exchangeGitHubOAuthCodeForUserToken(settings: Settings, code: string): Promise<string> {
+  if (!settings.githubClientId || !settings.githubClientSecret) {
+    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));
+  }
+  const response = await fetch("https://github.com/login/oauth/access_token", {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      client_id: settings.githubClientId,
+      client_secret: settings.githubClientSecret,
+      code,
+    }),
+  });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  const payload = await response.json();
+  if (!payload || typeof payload !== "object" || typeof payload.access_token !== "string") {
+    throw new GitHubAppApiError("GitHub returned an invalid OAuth token payload");
+  }
+  return payload.access_token;
+}
+
+async function listUserAccessibleInstallations(token: string): Promise<GitHubAppInstallationSummary[]> {
+  const out: GitHubAppInstallationSummary[] = [];
+  for (let page = 1; ; page += 1) {
+    const payload = await githubGet("/user/installations", token, { per_page: "100", page: String(page) });
+    const installations: unknown[] | null = payload && typeof payload === "object" && Array.isArray(payload.installations)
+      ? payload.installations as unknown[]
+      : null;
+    if (!installations) {
+      throw new GitHubAppApiError("GitHub returned an invalid user installations payload");
+    }
+    out.push(...installations
+      .filter((item): item is Record<string, unknown> => Boolean(item && typeof item === "object" && !Array.isArray(item)))
+      .map(installationSummaryFromPayload));
+    if (installations.length < 100) {
+      return out;
+    }
+  }
+}
+
+async function createInstallationToken(appJwt: string, input: {
+  installationId: number;
+  repositoryIds?: number[];
+}): Promise<string> {
+  const scoped = input.repositoryIds && input.repositoryIds.length > 0;
+  const response = await fetch(`${githubApiBase}/app/installations/${input.installationId}/access_tokens`, {
+    method: "POST",
+    headers: {
+      ...githubHeaders(appJwt),
+      ...(scoped ? { "Content-Type": "application/json" } : {}),
+    },
+    ...(scoped ? { body: JSON.stringify({ repository_ids: input.repositoryIds }) } : {}),
+  });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  const payload = await response.json();
+  if (!payload || typeof payload !== "object" || typeof payload.token !== "string") {
+    throw new GitHubAppApiError("GitHub returned an invalid installation token payload");
+  }
+  return payload.token;
+}
+
+async function listInstallationRepositories(token: string, installationId: number, account: Record<string, unknown>): Promise<GitHubRepository[]> {
+  const out: GitHubRepository[] = [];
+  for (let page = 1; ; page += 1) {
+    const payload = await githubGet("/installation/repositories", token, { per_page: "100", page: String(page) });
+    if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Array.isArray(payload.repositories)) {
+      throw new GitHubAppApiError("GitHub returned an invalid repositories payload");
+    }
+    for (const repo of payload.repositories) {
+      if (repo && typeof repo === "object" && !Array.isArray(repo)) {
+        out.push(repositoryFromPayload(repo as Record<string, unknown>, installationId, account));
+      }
+    }
+    if (payload.repositories.length < 100) {
+      return out;
+    }
+  }
+}
+
+function installationSummaryFromPayload(payload: Record<string, unknown>): GitHubAppInstallationSummary {
+  const installationId = asInt(payload.id);
+  if (installationId === null) {
+    throw new GitHubAppApiError("GitHub returned an installation without id");
+  }
+  const account = typeof payload.account === "object" && payload.account ? payload.account as Record<string, unknown> : {};
+  return {
+    installationId,
+    accountLogin: typeof account.login === "string" ? account.login : null,
+    accountType: typeof account.type === "string" ? account.type : null,
+    suspended: Boolean(payload.suspended_at),
+  };
+}
+
+async function githubGet(path: string, token: string, params: Record<string, string>): Promise<any> {
+  const url = new URL(`${githubApiBase}${path}`);
+  for (const [key, value] of Object.entries(params)) {
+    url.searchParams.set(key, value);
+  }
+  const response = await fetch(url, { headers: githubHeaders(token) });
+  if (!response.ok) {
+    throw new GitHubAppApiError(await githubErrorMessage(response));
+  }
+  return await response.json();
+}
+
+function repositoryFromPayload(payload: Record<string, unknown>, installationId: number, account: Record<string, unknown>): GitHubRepository {
+  const id = asInt(payload.id);
+  const fullName = String(payload.full_name ?? "");
+  if (id === null || !fullName) {
+    throw new GitHubAppApiError("GitHub returned a repository without id/full_name");
+  }
+  return {
+    id,
+    installationId,
+    fullName,
+    name: String(payload.name ?? fullName.split("/").at(-1) ?? fullName),
+    private: Boolean(payload.private),
+    htmlUrl: String(payload.html_url ?? `https://github.com/${fullName}`),
+    cloneUrl: String(payload.clone_url ?? `https://github.com/${fullName}.git`),
+    defaultBranch: String(payload.default_branch ?? "main"),
+    accountLogin: String(account.login ?? fullName.split("/", 1)[0]),
+    accountType: typeof account.type === "string" ? account.type : null,
+  };
+}
+
+function githubHeaders(token?: string): HeadersInit {
+  return {
+    Accept: "application/vnd.github+json",
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    "X-GitHub-Api-Version": githubApiVersion,
+  };
+}
+
+async function githubErrorMessage(response: Response): Promise<string> {
+  try {
+    const payload = await response.json();
+    if (payload && typeof payload === "object" && "message" in payload) {
+      return `GitHub API ${response.status}: ${String(payload.message)}`;
+    }
+  } catch {
+    // fall through
+  }
+  return `GitHub API ${response.status}: ${await response.text()}`;
+}
+
+export function normalizeGitHubAppPrivateKey(value: string): string {
+  const privateKey = value.trim().replace(/\\n/g, "\n");
+  if (!privateKey || privateKey.startsWith(pkcs8PrivateKeyHeader)) {
+    return privateKey;
+  }
+  if (privateKey.startsWith(rsaPrivateKeyHeader)) {
+    return createPrivateKey(privateKey).export({ type: "pkcs8", format: "pem" }).toString();
+  }
+  return privateKey;
+}
+
+function signStatePayload(encoded: string, secret: string): string {
+  return createHmac("sha256", secret).update(encoded).digest("base64url");
+}
+
+function safeEqual(left: string, right: string): boolean {
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+function asInt(value: unknown): number | null {
+  if (typeof value === "number" && Number.isInteger(value)) {
+    return value;
+  }
+  if (typeof value === "string" && /^\d+$/.test(value)) {
+    return Number(value);
+  }
+  return null;
+}