@opengeni/github 0.3.12 → 0.3.18

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Settings } from '@opengeni/config';
-import { GitHubUserInstallationAccess, GitHubRepository } from '@opengeni/contracts';
+import { GitHubUserInstallationAccess, GitHubInstallationBindingProof, GitHubRepository } from '@opengeni/contracts';
 
 declare const stateMaxAgeSeconds: number;
 declare class GitHubAppConfigurationError extends Error {
@@ -7,9 +7,17 @@ declare class GitHubAppConfigurationError extends Error {
     constructor(missing: string[]);
 }
 declare class GitHubAppApiError extends Error {
+    readonly status: number | null;
+    constructor(message: string, status?: number | null);
+}
+type GitHubInstallationAuthorityFailure = "authority_denied" | "authority_unavailable" | "installation_missing" | "installation_suspended" | "repository_access_empty";
+declare class GitHubInstallationAuthorityError extends GitHubAppApiError {
+    readonly reason: GitHubInstallationAuthorityFailure;
+    constructor(reason: GitHubInstallationAuthorityFailure, message: string, status?: number | null);
 }
 type GitHubAppInstallationSummary = {
     installationId: number;
+    accountId: number;
     accountLogin: string | null;
     accountType: string | null;
     suspended: boolean;
@@ -57,12 +65,26 @@ declare function verifyGitHubInstallationAccessForUser(settings: Settings, input
 declare function authorizeGitHubAppUser(settings: Settings, input: {
     code: string;
 }): Promise<GitHubUserInstallationAccess[]>;
+/**
+ * Prove current GitHub installation authority without treating repository
+ * administration or installation visibility as delegation authority.
+ *
+ * GitHub exposes an exact personal-account owner through the authenticated
+ * user's immutable id. For organizations, GitHub's authenticated membership
+ * endpoint exposes active owners as role=admin. GitHub does not expose an
+ * equivalent current-authority receipt for App Managers, so that case remains
+ * unsupported and fails closed.
+ */
+declare function authorizeGitHubInstallationBinding(settings: Settings, input: {
+    code: string;
+    installationId: number;
+}): Promise<GitHubInstallationBindingProof>;
 declare function listGitHubAppRepositories(settings: Settings, input?: {
     installationIds?: number[];
 }): Promise<GitHubRepository[]>;
 declare function createGitHubAppInstallationToken(settings: Settings, input: {
     installationId: number;
-    repositoryIds?: number[];
+    repositoryIds: number[];
 }): Promise<string>;
 type GitHubAppInstallationToken = {
     token: string;
@@ -70,7 +92,7 @@ type GitHubAppInstallationToken = {
 };
 declare function createGitHubAppInstallationTokenWithExpiry(settings: Settings, input: {
     installationId: number;
-    repositoryIds?: number[];
+    repositoryIds: number[];
 }): Promise<GitHubAppInstallationToken>;
 declare function githubAppBotIdentity(settings: Settings): {
     name: string;
@@ -78,4 +100,4 @@ declare function githubAppBotIdentity(settings: Settings): {
 } | null;
 declare function normalizeGitHubAppPrivateKey(value: string): string;
 
-export { GitHubAppApiError, GitHubAppConfigurationError, type GitHubAppInstallationSummary, type GitHubAppInstallationToken, type GitHubSignedStatePayload, authorizeGitHubAppUser, buildGitHubAppManifest, convertGitHubAppManifest, createGitHubAppInstallationToken, createGitHubAppInstallationTokenWithExpiry, createSignedState, envLinesFromGitHubManifestConversion, getGitHubAppInstallationSummary, githubAppBotIdentity, githubAppMissingSettings, githubOAuthAuthorizeUrl, listGitHubAppInstallationSummaries, listGitHubAppRepositories, normalizeGitHubAppPrivateKey, organizationAppManifestUrl, personalAppManifestUrl, readSignedState, stateMaxAgeSeconds, verifyGitHubInstallationAccessForUser, verifySignedState };
+export { GitHubAppApiError, GitHubAppConfigurationError, type GitHubAppInstallationSummary, type GitHubAppInstallationToken, GitHubInstallationAuthorityError, type GitHubInstallationAuthorityFailure, type GitHubSignedStatePayload, authorizeGitHubAppUser, authorizeGitHubInstallationBinding, buildGitHubAppManifest, convertGitHubAppManifest, createGitHubAppInstallationToken, createGitHubAppInstallationTokenWithExpiry, createSignedState, envLinesFromGitHubManifestConversion, getGitHubAppInstallationSummary, githubAppBotIdentity, githubAppMissingSettings, githubOAuthAuthorizeUrl, listGitHubAppInstallationSummaries, listGitHubAppRepositories, normalizeGitHubAppPrivateKey, organizationAppManifestUrl, personalAppManifestUrl, readSignedState, stateMaxAgeSeconds, verifyGitHubInstallationAccessForUser, verifySignedState };

package/dist/index.js

@@ -14,6 +14,16 @@ var GitHubAppConfigurationError = class extends Error {
   }
 };
 var GitHubAppApiError = class extends Error {
+  constructor(message, status = null) {
+    super(message);
+    this.status = status;
+  }
+};
+var GitHubInstallationAuthorityError = class extends GitHubAppApiError {
+  constructor(reason, message, status = null) {
+    super(message, status);
+    this.reason = reason;
+  }
 };
 function githubAppMissingSettings(settings) {
   const required = {
@@ -30,7 +40,11 @@ function buildGitHubAppManifest(input) {
   const permissions = {
     metadata: "read",
     contents: "write",
-    pull_requests: "write"
+    pull_requests: "write",
+    // Required for the authenticated-user membership endpoint that proves an
+    // active organization owner. Existing installations must approve this
+    // permission before organization-owner self-service can succeed.
+    members: "read"
   };
   if (input.includeCiPermissions) {
     permissions.actions = "read";
@@ -161,6 +175,87 @@ async function authorizeGitHubAppUser(settings, input) {
     }))
   );
 }
+async function authorizeGitHubInstallationBinding(settings, input) {
+  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);
+  const actor = await getAuthenticatedGitHubUser(userToken);
+  const visibleInstallations = await listUserAccessibleInstallations(userToken);
+  const visible = visibleInstallations.find(
+    (installation2) => installation2.installationId === input.installationId
+  );
+  if (!visible) {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "GitHub did not associate this installation with the authorized user"
+    );
+  }
+  const jwt = await createGitHubAppJwt(settings);
+  const livePayload = (await listInstallations(jwt)).find(
+    (installation2) => asInt(installation2.id) === input.installationId
+  );
+  if (!livePayload) {
+    throw new GitHubInstallationAuthorityError(
+      "installation_missing",
+      "GitHub App installation was deleted or is not owned by this App"
+    );
+  }
+  const installation = installationSummaryFromPayload(livePayload);
+  if (installation.accountId !== visible.accountId || installation.accountLogin !== visible.accountLogin || installation.accountType !== visible.accountType) {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "GitHub installation identity changed during authorization"
+    );
+  }
+  if (installation.suspended) {
+    throw new GitHubInstallationAuthorityError(
+      "installation_suspended",
+      "GitHub App installation is suspended"
+    );
+  }
+  let authorityKind;
+  if (installation.accountType === "User" && actor.id === installation.accountId) {
+    authorityKind = "personal_owner";
+  } else if (installation.accountType === "Organization" && installation.accountLogin) {
+    await assertActiveOrganizationOwner(
+      userToken,
+      installation.accountId,
+      installation.accountLogin
+    );
+    authorityKind = "organization_owner";
+  } else {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "Only a GitHub personal-account owner or organization owner may bind an installation"
+    );
+  }
+  const installationToken = await createInstallationToken(jwt, {
+    installationId: installation.installationId
+  });
+  const repositories = await listInstallationRepositories(
+    installationToken.token,
+    installation.installationId,
+    { login: installation.accountLogin, type: installation.accountType }
+  );
+  if (repositories.length === 0) {
+    throw new GitHubInstallationAuthorityError(
+      "repository_access_empty",
+      "GitHub App installation does not currently grant access to any repositories"
+    );
+  }
+  if (authorityKind === "organization_owner") {
+    await assertActiveOrganizationOwner(
+      userToken,
+      installation.accountId,
+      installation.accountLogin
+    );
+  }
+  return {
+    actorId: actor.id,
+    actorLogin: actor.login,
+    authorityKind,
+    installation,
+    repositories
+  };
+}
 async function listGitHubAppRepositories(settings, input = {}) {
   const missing = githubAppMissingSettings(settings);
   if (missing.length > 0) {
@@ -201,8 +296,22 @@ async function createGitHubAppInstallationTokenWithExpiry(settings, input) {
   if (missing.length > 0) {
     throw new GitHubAppConfigurationError(missing);
   }
+  if (!Array.isArray(input.repositoryIds)) {
+    throw new GitHubAppApiError(
+      "GitHub installation token mint requires an explicit, unique repository allowlist"
+    );
+  }
+  const repositoryIds = [...new Set(input.repositoryIds)];
+  if (!Number.isSafeInteger(input.installationId) || input.installationId <= 0 || repositoryIds.length === 0 || repositoryIds.length !== input.repositoryIds.length || repositoryIds.some((id) => !Number.isSafeInteger(id) || id <= 0)) {
+    throw new GitHubAppApiError(
+      "GitHub installation token mint requires an explicit, unique repository allowlist"
+    );
+  }
   const jwt = await createGitHubAppJwt(settings);
-  return await createInstallationToken(jwt, input);
+  return await createInstallationToken(jwt, {
+    installationId: input.installationId,
+    repositoryIds
+  });
 }
 function githubAppBotIdentity(settings) {
   const appId = settings.githubAppId?.trim();
@@ -271,6 +380,51 @@ async function exchangeGitHubOAuthCodeForUserToken(settings, code) {
   }
   return payload.access_token;
 }
+async function getAuthenticatedGitHubUser(token) {
+  const payload = await githubGet("/user", token);
+  const id = payload && typeof payload === "object" ? asInt(payload.id) : null;
+  const login = payload && typeof payload === "object" && typeof payload.login === "string" ? payload.login : null;
+  if (id === null || !login) {
+    throw new GitHubAppApiError("GitHub returned an invalid authenticated user payload");
+  }
+  return { id, login };
+}
+async function getAuthenticatedOrganizationMembership(token, organizationLogin) {
+  let payload;
+  try {
+    payload = await githubGet(
+      `/user/memberships/orgs/${encodeURIComponent(organizationLogin)}`,
+      token
+    );
+  } catch (error) {
+    if (error instanceof GitHubAppApiError) {
+      throw new GitHubInstallationAuthorityError(
+        "authority_unavailable",
+        "GitHub could not prove current organization-owner membership",
+        error.status
+      );
+    }
+    throw error;
+  }
+  const organization = payload && typeof payload === "object" && payload.organization ? payload.organization : null;
+  const organizationId = organization && typeof organization === "object" ? asInt(organization.id) : null;
+  if (organizationId === null || typeof payload?.role !== "string" || typeof payload?.state !== "string") {
+    throw new GitHubInstallationAuthorityError(
+      "authority_unavailable",
+      "GitHub returned an invalid organization membership proof"
+    );
+  }
+  return { organizationId, role: payload.role, state: payload.state };
+}
+async function assertActiveOrganizationOwner(token, organizationId, organizationLogin) {
+  const membership = await getAuthenticatedOrganizationMembership(token, organizationLogin);
+  if (membership.organizationId !== organizationId || membership.state !== "active" || membership.role !== "admin") {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "Only an active GitHub organization owner may bind this installation"
+    );
+  }
+}
 async function listUserAccessibleInstallations(token) {
   const out = [];
   for (let page = 1; ; page += 1) {
@@ -376,21 +530,26 @@ function installationSummaryFromPayload(payload) {
     throw new GitHubAppApiError("GitHub returned an installation without id");
   }
   const account = typeof payload.account === "object" && payload.account ? payload.account : {};
+  const accountId = asInt(account.id);
+  if (accountId === null) {
+    throw new GitHubAppApiError("GitHub returned an installation without an account id");
+  }
   return {
     installationId,
+    accountId,
     accountLogin: typeof account.login === "string" ? account.login : null,
     accountType: typeof account.type === "string" ? account.type : null,
     suspended: Boolean(payload.suspended_at)
   };
 }
-async function githubGet(path, token, params) {
+async function githubGet(path, token, params = {}) {
   const url = new URL(`${githubApiBase}${path}`);
   for (const [key, value] of Object.entries(params)) {
     url.searchParams.set(key, value);
   }
   const response = await fetch(url, { headers: githubHeaders(token) });
   if (!response.ok) {
-    throw new GitHubAppApiError(await githubErrorMessage(response));
+    throw new GitHubAppApiError(await githubErrorMessage(response), response.status);
   }
   return await response.json();
 }
@@ -470,7 +629,9 @@ function asInt(value) {
 export {
   GitHubAppApiError,
   GitHubAppConfigurationError,
+  GitHubInstallationAuthorityError,
   authorizeGitHubAppUser,
+  authorizeGitHubInstallationBinding,
   buildGitHubAppManifest,
   convertGitHubAppManifest,
   createGitHubAppInstallationToken,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type {\n  GitHubRepository,\n  GitHubRepositoryPermissions,\n  GitHubUserInstallationAccess,\n  GitHubUserRepositoryAccess,\n} from \"@opengeni/contracts\";\nimport { createHmac, createPrivateKey, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { SignJWT, importPKCS8 } from \"jose\";\n\nconst githubApiBase = \"https://api.github.com\";\nconst githubApiVersion = \"2022-11-28\";\nconst githubTokenMintTimeoutMs = 60_000;\nexport const stateMaxAgeSeconds = 60 * 60;\nconst pkcs8PrivateKeyHeader = `-----BEGIN ${\"PRIVATE KEY\"}-----`;\nconst rsaPrivateKeyHeader = `-----BEGIN ${\"RSA PRIVATE KEY\"}-----`;\n\nexport class GitHubAppConfigurationError extends Error {\n  constructor(readonly missing: string[]) {\n    super(\"GitHub App is not configured\");\n  }\n}\n\nexport class GitHubAppApiError extends Error {}\n\nexport type GitHubAppInstallationSummary = {\n  installationId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubSignedStatePayload = {\n  nonce: string;\n  iat: number;\n  accountId?: string;\n  workspaceId?: string;\n  [key: string]: unknown;\n};\n\nexport function githubAppMissingSettings(settings: Settings): string[] {\n  const required: Record<string, string | undefined> = {\n    OPENGENI_GITHUB_APP_ID: settings.githubAppId,\n    OPENGENI_GITHUB_CLIENT_ID: settings.githubClientId,\n    OPENGENI_GITHUB_CLIENT_SECRET: settings.githubClientSecret,\n    OPENGENI_GITHUB_APP_SLUG: settings.githubAppSlug,\n    OPENGENI_GITHUB_APP_PRIVATE_KEY: settings.githubAppPrivateKey,\n  };\n  return Object.entries(required).flatMap(([name, value]) => (value && value.trim() ? [] : [name]));\n}\n\nexport function buildGitHubAppManifest(input: {\n  appName: string;\n  baseUrl: string;\n  public: boolean;\n  includeCiPermissions: boolean;\n  setupUrl?: string;\n}): Record<string, unknown> {\n  const base = input.baseUrl.replace(/\\/+$/, \"\");\n  const permissions: Record<string, string> = {\n    metadata: \"read\",\n    contents: \"write\",\n    pull_requests: \"write\",\n  };\n  if (input.includeCiPermissions) {\n    permissions.actions = \"read\";\n    permissions.checks = \"read\";\n    permissions.statuses = \"write\";\n  }\n  const manifest: Record<string, unknown> = {\n    name: input.appName,\n    url: base,\n    redirect_url: `${base}/v1/github/app-manifest/callback`,\n    callback_urls: [`${base}/v1/github/oauth/callback`],\n    public: input.public,\n    request_oauth_on_install: true,\n    default_permissions: permissions,\n  };\n  if (input.setupUrl) {\n    manifest.setup_url = input.setupUrl;\n    manifest.setup_on_update = true;\n  }\n  return manifest;\n}\n\nexport function personalAppManifestUrl(state: string): string {\n  return `https://github.com/settings/apps/new?state=${state}`;\n}\n\nexport function organizationAppManifestUrl(organization: string, state: string): string {\n  return `https://github.com/organizations/${encodeURIComponent(organization)}/settings/apps/new?state=${state}`;\n}\n\nexport function githubOAuthAuthorizeUrl(input: {\n  clientId: string;\n  state: string;\n  redirectUri?: string;\n}): string {\n  const url = new URL(\"https://github.com/login/oauth/authorize\");\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"state\", input.state);\n  if (input.redirectUri) {\n    url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  }\n  return url.toString();\n}\n\nexport function createSignedState(\n  secret: string,\n  payloadOrNow: Record<string, unknown> | number = {},\n  nowArg = Math.floor(Date.now() / 1000),\n): string {\n  const payloadInput = typeof payloadOrNow === \"number\" ? {} : payloadOrNow;\n  const now = typeof payloadOrNow === \"number\" ? payloadOrNow : nowArg;\n  const payload = {\n    ...payloadInput,\n    nonce: randomBytes(16).toString(\"base64url\"),\n    iat: now,\n  };\n  const encoded = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  return `${encoded}.${signStatePayload(encoded, secret)}`;\n}\n\nexport function readSignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): GitHubSignedStatePayload | null {\n  const [encoded, signature] = state.split(\".\", 2);\n  if (!encoded || !signature) {\n    return null;\n  }\n  const expected = signStatePayload(encoded, secret);\n  if (!safeEqual(signature, expected)) {\n    return null;\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return null;\n  }\n  if (\n    !payload ||\n    typeof payload !== \"object\" ||\n    typeof (payload as { iat?: unknown }).iat !== \"number\" ||\n    typeof (payload as { nonce?: unknown }).nonce !== \"string\"\n  ) {\n    return null;\n  }\n  const age = now - (payload as { iat: number }).iat;\n  return age >= 0 && age <= stateMaxAgeSeconds ? (payload as GitHubSignedStatePayload) : null;\n}\n\nexport function verifySignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): boolean {\n  return readSignedState(state, secret, now) !== null;\n}\n\nexport function envLinesFromGitHubManifestConversion(payload: Record<string, unknown>): string[] {\n  const privateKey = String(payload.pem ?? \"\").replace(/\\n/g, \"\\\\n\");\n  return [\n    `OPENGENI_GITHUB_APP_ID=${payload.id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_ID=${payload.client_id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_SECRET=${payload.client_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_SLUG=${payload.slug ?? \"\"}`,\n    `OPENGENI_GITHUB_WEBHOOK_SECRET=${payload.webhook_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_PRIVATE_KEY=\"${privateKey}\"`,\n  ];\n}\n\nexport async function convertGitHubAppManifest(code: string): Promise<Record<string, unknown>> {\n  const response = await fetch(`${githubApiBase}/app-manifests/${code}/conversions`, {\n    method: \"POST\",\n    headers: githubHeaders(undefined),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || Array.isArray(payload)) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid manifest conversion payload\");\n  }\n  return payload as Record<string, unknown>;\n}\n\nexport async function listGitHubAppInstallationSummaries(\n  settings: Settings,\n): Promise<GitHubAppInstallationSummary[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  return installations.map(installationSummaryFromPayload);\n}\n\nexport async function getGitHubAppInstallationSummary(\n  settings: Settings,\n  installationId: number,\n): Promise<GitHubAppInstallationSummary | null> {\n  const installations = await listGitHubAppInstallationSummaries(settings);\n  return (\n    installations.find((installation) => installation.installationId === installationId) ?? null\n  );\n}\n\nexport async function verifyGitHubInstallationAccessForUser(\n  settings: Settings,\n  input: {\n    code: string;\n    installationId: number;\n  },\n): Promise<GitHubAppInstallationSummary> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  const installation = installations.find(\n    (candidate) => candidate.installationId === input.installationId,\n  );\n  if (!installation) {\n    throw new GitHubAppApiError(\"GitHub installation is not accessible to the installing user\");\n  }\n  return installation;\n}\n\n/**\n * Exchange a GitHub App user-authorization code and discover the installations\n * and repositories the user can explicitly access. This is compatibility\n * discovery metadata only: visibility and repository permission bits do not\n * prove that the human may install, configure, or bind the App installation.\n * No production binding path may treat this result as authority.\n */\nexport async function authorizeGitHubAppUser(\n  settings: Settings,\n  input: { code: string },\n): Promise<GitHubUserInstallationAccess[]> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  return await Promise.all(\n    installations.map(async (installation) => ({\n      ...installation,\n      repositories: installation.suspended\n        ? []\n        : await listUserInstallationRepositories(token, installation),\n    })),\n  );\n}\n\nexport async function listGitHubAppRepositories(\n  settings: Settings,\n  input: {\n    installationIds?: number[];\n  } = {},\n): Promise<GitHubRepository[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const allowedInstallations = input.installationIds ? new Set(input.installationIds) : null;\n  if (allowedInstallations && allowedInstallations.size === 0) {\n    return [];\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  const repositories: GitHubRepository[] = [];\n  for (const installation of installations) {\n    if (installation.suspended_at) {\n      continue;\n    }\n    const installationId = asInt(installation.id);\n    if (installationId === null) {\n      continue;\n    }\n    if (allowedInstallations && !allowedInstallations.has(installationId)) {\n      continue;\n    }\n    const account =\n      typeof installation.account === \"object\" && installation.account\n        ? (installation.account as Record<string, unknown>)\n        : {};\n    const token = await createInstallationToken(jwt, { installationId });\n    repositories.push(\n      ...(await listInstallationRepositories(token.token, installationId, account)),\n    );\n  }\n  repositories.sort((left, right) => left.fullName.localeCompare(right.fullName));\n  return repositories;\n}\n\nexport async function createGitHubAppInstallationToken(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds?: number[];\n  },\n): Promise<string> {\n  return (await createGitHubAppInstallationTokenWithExpiry(settings, input)).token;\n}\n\nexport type GitHubAppInstallationToken = {\n  token: string;\n  expiresAt: string | null;\n};\n\nexport async function createGitHubAppInstallationTokenWithExpiry(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds?: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  return await createInstallationToken(jwt, input);\n}\n\nexport function githubAppBotIdentity(settings: Settings): { name: string; email: string } | null {\n  const appId = settings.githubAppId?.trim();\n  const slug = settings.githubAppSlug?.trim();\n  if (!appId || !slug) {\n    return null;\n  }\n  const login = `${slug}[bot]`;\n  return {\n    name: login,\n    email: `${appId}+${login}@users.noreply.github.com`,\n  };\n}\n\nasync function createGitHubAppJwt(settings: Settings): Promise<string> {\n  const privateKey = normalizeGitHubAppPrivateKey(settings.githubAppPrivateKey ?? \"\");\n  const appId = settings.githubAppId?.trim();\n  if (!appId || !privateKey) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const key = await importPKCS8(privateKey, \"RS256\");\n  const now = Math.floor(Date.now() / 1000);\n  return await new SignJWT({})\n    .setProtectedHeader({ alg: \"RS256\" })\n    .setIssuedAt(now - 60)\n    .setExpirationTime(now + 9 * 60)\n    .setIssuer(appId)\n    .sign(key);\n}\n\nasync function listInstallations(token: string): Promise<Array<Record<string, unknown>>> {\n  const out: Array<Record<string, unknown>> = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/app/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (!Array.isArray(payload)) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid installations payload\");\n    }\n    out.push(\n      ...payload.filter((item): item is Record<string, unknown> =>\n        Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n      ),\n    );\n    if (payload.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function exchangeGitHubOAuthCodeForUserToken(\n  settings: Settings,\n  code: string,\n): Promise<string> {\n  if (!settings.githubClientId || !settings.githubClientSecret) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const response = await fetch(\"https://github.com/login/oauth/access_token\", {\n    method: \"POST\",\n    headers: {\n      Accept: \"application/json\",\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      client_id: settings.githubClientId,\n      client_secret: settings.githubClientSecret,\n      code,\n    }),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.access_token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid OAuth token payload\");\n  }\n  return payload.access_token;\n}\n\nasync function listUserAccessibleInstallations(\n  token: string,\n): Promise<GitHubAppInstallationSummary[]> {\n  const out: GitHubAppInstallationSummary[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/user/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    const installations: unknown[] | null =\n      payload && typeof payload === \"object\" && Array.isArray(payload.installations)\n        ? (payload.installations as unknown[])\n        : null;\n    if (!installations) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid user installations payload\");\n    }\n    out.push(\n      ...installations\n        .filter((item): item is Record<string, unknown> =>\n          Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n        )\n        .map(installationSummaryFromPayload),\n    );\n    if (installations.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function listUserInstallationRepositories(\n  token: string,\n  installation: GitHubAppInstallationSummary,\n): Promise<GitHubUserRepositoryAccess[]> {\n  const out: GitHubUserRepositoryAccess[] = [];\n  const account = {\n    ...(installation.accountLogin ? { login: installation.accountLogin } : {}),\n    ...(installation.accountType ? { type: installation.accountType } : {}),\n  };\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\n      `/user/installations/${installation.installationId}/repositories`,\n      token,\n      { per_page: \"100\", page: String(page) },\n    );\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\n        \"GitHub returned an invalid user installation repositories payload\",\n      );\n    }\n    for (const repository of payload.repositories) {\n      if (!repository || typeof repository !== \"object\" || Array.isArray(repository)) {\n        continue;\n      }\n      const record = repository as Record<string, unknown>;\n      out.push({\n        ...repositoryFromPayload(record, installation.installationId, account),\n        permissions: repositoryPermissionsFromPayload(record.permissions),\n      });\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function createInstallationToken(\n  appJwt: string,\n  input: {\n    installationId: number;\n    repositoryIds?: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const scoped = input.repositoryIds && input.repositoryIds.length > 0;\n  const response = await fetch(\n    `${githubApiBase}/app/installations/${input.installationId}/access_tokens`,\n    {\n      method: \"POST\",\n      headers: {\n        ...githubHeaders(appJwt),\n        ...(scoped ? { \"Content-Type\": \"application/json\" } : {}),\n      },\n      signal: AbortSignal.timeout(githubTokenMintTimeoutMs),\n      ...(scoped ? { body: JSON.stringify({ repository_ids: input.repositoryIds }) } : {}),\n    },\n  );\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid installation token payload\");\n  }\n  return {\n    token: payload.token,\n    expiresAt: typeof payload.expires_at === \"string\" ? payload.expires_at : null,\n  };\n}\n\nasync function listInstallationRepositories(\n  token: string,\n  installationId: number,\n  account: Record<string, unknown>,\n): Promise<GitHubRepository[]> {\n  const out: GitHubRepository[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/installation/repositories\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid repositories payload\");\n    }\n    for (const repo of payload.repositories) {\n      if (repo && typeof repo === \"object\" && !Array.isArray(repo)) {\n        out.push(repositoryFromPayload(repo as Record<string, unknown>, installationId, account));\n      }\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nfunction installationSummaryFromPayload(\n  payload: Record<string, unknown>,\n): GitHubAppInstallationSummary {\n  const installationId = asInt(payload.id);\n  if (installationId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without id\");\n  }\n  const account =\n    typeof payload.account === \"object\" && payload.account\n      ? (payload.account as Record<string, unknown>)\n      : {};\n  return {\n    installationId,\n    accountLogin: typeof account.login === \"string\" ? account.login : null,\n    accountType: typeof account.type === \"string\" ? account.type : null,\n    suspended: Boolean(payload.suspended_at),\n  };\n}\n\nasync function githubGet(\n  path: string,\n  token: string,\n  params: Record<string, string>,\n): Promise<any> {\n  const url = new URL(`${githubApiBase}${path}`);\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, value);\n  }\n  const response = await fetch(url, { headers: githubHeaders(token) });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  return await response.json();\n}\n\nfunction repositoryFromPayload(\n  payload: Record<string, unknown>,\n  installationId: number,\n  account: Record<string, unknown>,\n): GitHubRepository {\n  const id = asInt(payload.id);\n  const fullName = String(payload.full_name ?? \"\");\n  if (id === null || !fullName) {\n    throw new GitHubAppApiError(\"GitHub returned a repository without id/full_name\");\n  }\n  return {\n    id,\n    installationId,\n    fullName,\n    name: String(payload.name ?? fullName.split(\"/\").at(-1) ?? fullName),\n    private: Boolean(payload.private),\n    htmlUrl: String(payload.html_url ?? `https://github.com/${fullName}`),\n    cloneUrl: String(payload.clone_url ?? `https://github.com/${fullName}.git`),\n    defaultBranch: String(payload.default_branch ?? \"main\"),\n    accountLogin: String(account.login ?? fullName.split(\"/\", 1)[0]),\n    accountType: typeof account.type === \"string\" ? account.type : null,\n  };\n}\n\nfunction repositoryPermissionsFromPayload(payload: unknown): GitHubRepositoryPermissions {\n  const permissions =\n    payload && typeof payload === \"object\" && !Array.isArray(payload)\n      ? (payload as Record<string, unknown>)\n      : {};\n  return {\n    admin: permissions.admin === true,\n    maintain: permissions.maintain === true,\n    push: permissions.push === true,\n    triage: permissions.triage === true,\n    pull: permissions.pull === true,\n  };\n}\n\nfunction githubHeaders(token?: string): HeadersInit {\n  return {\n    Accept: \"application/vnd.github+json\",\n    ...(token ? { Authorization: `Bearer ${token}` } : {}),\n    \"X-GitHub-Api-Version\": githubApiVersion,\n  };\n}\n\nasync function githubErrorMessage(response: Response): Promise<string> {\n  try {\n    const payload = await response.json();\n    if (payload && typeof payload === \"object\" && \"message\" in payload) {\n      return `GitHub API ${response.status}: ${String(payload.message)}`;\n    }\n  } catch {\n    // fall through\n  }\n  return `GitHub API ${response.status}: ${await response.text()}`;\n}\n\nexport function normalizeGitHubAppPrivateKey(value: string): string {\n  const privateKey = value.trim().replace(/\\\\n/g, \"\\n\");\n  if (!privateKey || privateKey.startsWith(pkcs8PrivateKeyHeader)) {\n    return privateKey;\n  }\n  if (privateKey.startsWith(rsaPrivateKeyHeader)) {\n    return createPrivateKey(privateKey).export({ type: \"pkcs8\", format: \"pem\" }).toString();\n  }\n  return privateKey;\n}\n\nfunction signStatePayload(encoded: string, secret: string): string {\n  return createHmac(\"sha256\", secret).update(encoded).digest(\"base64url\");\n}\n\nfunction safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction asInt(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value)) {\n    return value;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) {\n    return Number(value);\n  }\n  return null;\n}\n"],"mappings":";AAOA,SAAS,YAAY,kBAAkB,aAAa,uBAAuB;AAC3E,SAAS,SAAS,mBAAmB;AAErC,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,2BAA2B;AAC1B,IAAM,qBAAqB,KAAK;AACvC,IAAM,wBAAwB,cAAc,aAAa;AACzD,IAAM,sBAAsB,cAAc,iBAAiB;AAEpD,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAqB,SAAmB;AACtC,UAAM,8BAA8B;AADjB;AAAA,EAErB;AACF;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAC;AAiBvC,SAAS,yBAAyB,UAA8B;AACrE,QAAM,WAA+C;AAAA,IACnD,wBAAwB,SAAS;AAAA,IACjC,2BAA2B,SAAS;AAAA,IACpC,+BAA+B,SAAS;AAAA,IACxC,0BAA0B,SAAS;AAAA,IACnC,iCAAiC,SAAS;AAAA,EAC5C;AACA,SAAO,OAAO,QAAQ,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAO,SAAS,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE;AAClG;AAEO,SAAS,uBAAuB,OAMX;AAC1B,QAAM,OAAO,MAAM,QAAQ,QAAQ,QAAQ,EAAE;AAC7C,QAAM,cAAsC;AAAA,IAC1C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AACA,MAAI,MAAM,sBAAsB;AAC9B,gBAAY,UAAU;AACtB,gBAAY,SAAS;AACrB,gBAAY,WAAW;AAAA,EACzB;AACA,QAAM,WAAoC;AAAA,IACxC,MAAM,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,cAAc,GAAG,IAAI;AAAA,IACrB,eAAe,CAAC,GAAG,IAAI,2BAA2B;AAAA,IAClD,QAAQ,MAAM;AAAA,IACd,0BAA0B;AAAA,IAC1B,qBAAqB;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,aAAS,YAAY,MAAM;AAC3B,aAAS,kBAAkB;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAuB;AAC5D,SAAO,8CAA8C,KAAK;AAC5D;AAEO,SAAS,2BAA2B,cAAsB,OAAuB;AACtF,SAAO,oCAAoC,mBAAmB,YAAY,CAAC,4BAA4B,KAAK;AAC9G;AAEO,SAAS,wBAAwB,OAI7B;AACT,QAAM,MAAM,IAAI,IAAI,0CAA0C;AAC9D,MAAI,aAAa,IAAI,aAAa,MAAM,QAAQ;AAChD,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,MAAI,MAAM,aAAa;AACrB,QAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;AAAA,EACxD;AACA,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,kBACd,QACA,eAAiD,CAAC,GAClD,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC7B;AACR,QAAM,eAAe,OAAO,iBAAiB,WAAW,CAAC,IAAI;AAC7D,QAAM,MAAM,OAAO,iBAAiB,WAAW,eAAe;AAC9D,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,IAC3C,KAAK;AAAA,EACP;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AACzE,SAAO,GAAG,OAAO,IAAI,iBAAiB,SAAS,MAAM,CAAC;AACxD;AAEO,SAAS,gBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACD;AACjC,QAAM,CAAC,SAAS,SAAS,IAAI,MAAM,MAAM,KAAK,CAAC;AAC/C,MAAI,CAAC,WAAW,CAAC,WAAW;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,iBAAiB,SAAS,MAAM;AACjD,MAAI,CAAC,UAAU,WAAW,QAAQ,GAAG;AACnC,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,CAAC,WACD,OAAO,YAAY,YACnB,OAAQ,QAA8B,QAAQ,YAC9C,OAAQ,QAAgC,UAAU,UAClD;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAO,QAA4B;AAC/C,SAAO,OAAO,KAAK,OAAO,qBAAsB,UAAuC;AACzF;AAEO,SAAS,kBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACzB;AACT,SAAO,gBAAgB,OAAO,QAAQ,GAAG,MAAM;AACjD;AAEO,SAAS,qCAAqC,SAA4C;AAC/F,QAAM,aAAa,OAAO,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,KAAK;AACjE,SAAO;AAAA,IACL,0BAA0B,QAAQ,MAAM,EAAE;AAAA,IAC1C,6BAA6B,QAAQ,aAAa,EAAE;AAAA,IACpD,iCAAiC,QAAQ,iBAAiB,EAAE;AAAA,IAC5D,4BAA4B,QAAQ,QAAQ,EAAE;AAAA,IAC9C,kCAAkC,QAAQ,kBAAkB,EAAE;AAAA,IAC9D,oCAAoC,UAAU;AAAA,EAChD;AACF;AAEA,eAAsB,yBAAyB,MAAgD;AAC7F,QAAM,WAAW,MAAM,MAAM,GAAG,aAAa,kBAAkB,IAAI,gBAAgB;AAAA,IACjF,QAAQ;AAAA,IACR,SAAS,cAAc,MAAS;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,UAAM,IAAI,kBAAkB,wDAAwD;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,mCACpB,UACyC;AACzC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,SAAO,cAAc,IAAI,8BAA8B;AACzD;AAEA,eAAsB,gCACpB,UACA,gBAC8C;AAC9C,QAAM,gBAAgB,MAAM,mCAAmC,QAAQ;AACvE,SACE,cAAc,KAAK,CAAC,iBAAiB,aAAa,mBAAmB,cAAc,KAAK;AAE5F;AAEA,eAAsB,sCACpB,UACA,OAIuC;AACvC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,QAAM,eAAe,cAAc;AAAA,IACjC,CAAC,cAAc,UAAU,mBAAmB,MAAM;AAAA,EACpD;AACA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,kBAAkB,8DAA8D;AAAA,EAC5F;AACA,SAAO;AACT;AASA,eAAsB,uBACpB,UACA,OACyC;AACzC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,SAAO,MAAM,QAAQ;AAAA,IACnB,cAAc,IAAI,OAAO,kBAAkB;AAAA,MACzC,GAAG;AAAA,MACH,cAAc,aAAa,YACvB,CAAC,IACD,MAAM,iCAAiC,OAAO,YAAY;AAAA,IAChE,EAAE;AAAA,EACJ;AACF;AAEA,eAAsB,0BACpB,UACA,QAEI,CAAC,GACwB;AAC7B,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,uBAAuB,MAAM,kBAAkB,IAAI,IAAI,MAAM,eAAe,IAAI;AACtF,MAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC3D,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,QAAM,eAAmC,CAAC;AAC1C,aAAW,gBAAgB,eAAe;AACxC,QAAI,aAAa,cAAc;AAC7B;AAAA,IACF;AACA,UAAM,iBAAiB,MAAM,aAAa,EAAE;AAC5C,QAAI,mBAAmB,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,wBAAwB,CAAC,qBAAqB,IAAI,cAAc,GAAG;AACrE;AAAA,IACF;AACA,UAAM,UACJ,OAAO,aAAa,YAAY,YAAY,aAAa,UACpD,aAAa,UACd,CAAC;AACP,UAAM,QAAQ,MAAM,wBAAwB,KAAK,EAAE,eAAe,CAAC;AACnE,iBAAa;AAAA,MACX,GAAI,MAAM,6BAA6B,MAAM,OAAO,gBAAgB,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,eAAa,KAAK,CAAC,MAAM,UAAU,KAAK,SAAS,cAAc,MAAM,QAAQ,CAAC;AAC9E,SAAO;AACT;AAEA,eAAsB,iCACpB,UACA,OAIiB;AACjB,UAAQ,MAAM,2CAA2C,UAAU,KAAK,GAAG;AAC7E;AAOA,eAAsB,2CACpB,UACA,OAIqC;AACrC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,SAAO,MAAM,wBAAwB,KAAK,KAAK;AACjD;AAEO,SAAS,qBAAqB,UAA4D;AAC/F,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,QAAM,OAAO,SAAS,eAAe,KAAK;AAC1C,MAAI,CAAC,SAAS,CAAC,MAAM;AACnB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,GAAG,IAAI;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,GAAG,KAAK,IAAI,KAAK;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,QAAM,aAAa,6BAA6B,SAAS,uBAAuB,EAAE;AAClF,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,MAAI,CAAC,SAAS,CAAC,YAAY;AACzB,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,MAAM,MAAM,YAAY,YAAY,OAAO;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,EACxB,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,MAAM,EAAE,EACpB,kBAAkB,MAAM,IAAI,EAAE,EAC9B,UAAU,KAAK,EACf,KAAK,GAAG;AACb;AAEA,eAAe,kBAAkB,OAAwD;AACvF,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,sBAAsB,OAAO;AAAA,MAC3D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,YAAM,IAAI,kBAAkB,kDAAkD;AAAA,IAChF;AACA,QAAI;AAAA,MACF,GAAG,QAAQ;AAAA,QAAO,CAAC,SACjB,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,oCACb,UACA,MACiB;AACjB,MAAI,CAAC,SAAS,kBAAkB,CAAC,SAAS,oBAAoB;AAC5D,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,WAAW,MAAM,MAAM,+CAA+C;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,eAAe,SAAS;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,iBAAiB,UAAU;AACvF,UAAM,IAAI,kBAAkB,gDAAgD;AAAA,EAC9E;AACA,SAAO,QAAQ;AACjB;AAEA,eAAe,gCACb,OACyC;AACzC,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,uBAAuB,OAAO;AAAA,MAC5D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,UAAM,gBACJ,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,QAAQ,aAAa,IACxE,QAAQ,gBACT;AACN,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,kBAAkB,uDAAuD;AAAA,IACrF;AACA,QAAI;AAAA,MACF,GAAG,cACA;AAAA,QAAO,CAAC,SACP,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE,EACC,IAAI,8BAA8B;AAAA,IACvC;AACA,QAAI,cAAc,SAAS,KAAK;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,iCACb,OACA,cACuC;AACvC,QAAM,MAAoC,CAAC;AAC3C,QAAM,UAAU;AAAA,IACd,GAAI,aAAa,eAAe,EAAE,OAAO,aAAa,aAAa,IAAI,CAAC;AAAA,IACxE,GAAI,aAAa,cAAc,EAAE,MAAM,aAAa,YAAY,IAAI,CAAC;AAAA,EACvE;AACA,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM;AAAA,MACpB,uBAAuB,aAAa,cAAc;AAAA,MAClD;AAAA,MACA,EAAE,UAAU,OAAO,MAAM,OAAO,IAAI,EAAE;AAAA,IACxC;AACA,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,eAAW,cAAc,QAAQ,cAAc;AAC7C,UAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AAC9E;AAAA,MACF;AACA,YAAM,SAAS;AACf,UAAI,KAAK;AAAA,QACP,GAAG,sBAAsB,QAAQ,aAAa,gBAAgB,OAAO;AAAA,QACrE,aAAa,iCAAiC,OAAO,WAAW;AAAA,MAClE,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,wBACb,QACA,OAIqC;AACrC,QAAM,SAAS,MAAM,iBAAiB,MAAM,cAAc,SAAS;AACnE,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,aAAa,sBAAsB,MAAM,cAAc;AAAA,IAC1D;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,GAAG,cAAc,MAAM;AAAA,QACvB,GAAI,SAAS,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,MACzD;AAAA,MACA,QAAQ,YAAY,QAAQ,wBAAwB;AAAA,MACpD,GAAI,SAAS,EAAE,MAAM,KAAK,UAAU,EAAE,gBAAgB,MAAM,cAAc,CAAC,EAAE,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,UAAU;AAChF,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,WAAW,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,EAC3E;AACF;AAEA,eAAe,6BACb,OACA,gBACA,SAC6B;AAC7B,QAAM,MAA0B,CAAC;AACjC,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,8BAA8B,OAAO;AAAA,MACnE,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI,kBAAkB,iDAAiD;AAAA,IAC/E;AACA,eAAW,QAAQ,QAAQ,cAAc;AACvC,UAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AAC5D,YAAI,KAAK,sBAAsB,MAAiC,gBAAgB,OAAO,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,+BACP,SAC8B;AAC9B,QAAM,iBAAiB,MAAM,QAAQ,EAAE;AACvC,MAAI,mBAAmB,MAAM;AAC3B,UAAM,IAAI,kBAAkB,4CAA4C;AAAA,EAC1E;AACA,QAAM,UACJ,OAAO,QAAQ,YAAY,YAAY,QAAQ,UAC1C,QAAQ,UACT,CAAC;AACP,SAAO;AAAA,IACL;AAAA,IACA,cAAc,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAClE,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IAC/D,WAAW,QAAQ,QAAQ,YAAY;AAAA,EACzC;AACF;AAEA,eAAe,UACb,MACA,OACA,QACc;AACd,QAAM,MAAM,IAAI,IAAI,GAAG,aAAa,GAAG,IAAI,EAAE;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AACnE,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,SAAO,MAAM,SAAS,KAAK;AAC7B;AAEA,SAAS,sBACP,SACA,gBACA,SACkB;AAClB,QAAM,KAAK,MAAM,QAAQ,EAAE;AAC3B,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAC/C,MAAI,OAAO,QAAQ,CAAC,UAAU;AAC5B,UAAM,IAAI,kBAAkB,mDAAmD;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,QAAQ,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,QAAQ;AAAA,IACnE,SAAS,QAAQ,QAAQ,OAAO;AAAA,IAChC,SAAS,OAAO,QAAQ,YAAY,sBAAsB,QAAQ,EAAE;AAAA,IACpE,UAAU,OAAO,QAAQ,aAAa,sBAAsB,QAAQ,MAAM;AAAA,IAC1E,eAAe,OAAO,QAAQ,kBAAkB,MAAM;AAAA,IACtD,cAAc,OAAO,QAAQ,SAAS,SAAS,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,IAC/D,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,EACjE;AACF;AAEA,SAAS,iCAAiC,SAA+C;AACvF,QAAM,cACJ,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3D,UACD,CAAC;AACP,SAAO;AAAA,IACL,OAAO,YAAY,UAAU;AAAA,IAC7B,UAAU,YAAY,aAAa;AAAA,IACnC,MAAM,YAAY,SAAS;AAAA,IAC3B,QAAQ,YAAY,WAAW;AAAA,IAC/B,MAAM,YAAY,SAAS;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,OAA6B;AAClD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,GAAI,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AAAA,IACpD,wBAAwB;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,MAAI;AACF,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,QAAI,WAAW,OAAO,YAAY,YAAY,aAAa,SAAS;AAClE,aAAO,cAAc,SAAS,MAAM,KAAK,OAAO,QAAQ,OAAO,CAAC;AAAA,IAClE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,cAAc,SAAS,MAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAChE;AAEO,SAAS,6BAA6B,OAAuB;AAClE,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,QAAQ,IAAI;AACpD,MAAI,CAAC,cAAc,WAAW,WAAW,qBAAqB,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,MAAI,WAAW,WAAW,mBAAmB,GAAG;AAC9C,WAAO,iBAAiB,UAAU,EAAE,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,QAAwB;AACjE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW;AACxE;AAEA,SAAS,UAAU,MAAc,OAAwB;AACvD,QAAM,IAAI,OAAO,KAAK,IAAI;AAC1B,QAAM,IAAI,OAAO,KAAK,KAAK;AAC3B,SAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAEA,SAAS,MAAM,OAA+B;AAC5C,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,GAAG;AACpD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type {\n  GitHubInstallationBindingProof,\n  GitHubRepository,\n  GitHubRepositoryPermissions,\n  GitHubUserInstallationAccess,\n  GitHubUserRepositoryAccess,\n} from \"@opengeni/contracts\";\nimport { createHmac, createPrivateKey, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { SignJWT, importPKCS8 } from \"jose\";\n\nconst githubApiBase = \"https://api.github.com\";\nconst githubApiVersion = \"2022-11-28\";\nconst githubTokenMintTimeoutMs = 60_000;\nexport const stateMaxAgeSeconds = 60 * 60;\nconst pkcs8PrivateKeyHeader = `-----BEGIN ${\"PRIVATE KEY\"}-----`;\nconst rsaPrivateKeyHeader = `-----BEGIN ${\"RSA PRIVATE KEY\"}-----`;\n\nexport class GitHubAppConfigurationError extends Error {\n  constructor(readonly missing: string[]) {\n    super(\"GitHub App is not configured\");\n  }\n}\n\nexport class GitHubAppApiError extends Error {\n  constructor(\n    message: string,\n    readonly status: number | null = null,\n  ) {\n    super(message);\n  }\n}\n\nexport type GitHubInstallationAuthorityFailure =\n  | \"authority_denied\"\n  | \"authority_unavailable\"\n  | \"installation_missing\"\n  | \"installation_suspended\"\n  | \"repository_access_empty\";\n\nexport class GitHubInstallationAuthorityError extends GitHubAppApiError {\n  constructor(\n    readonly reason: GitHubInstallationAuthorityFailure,\n    message: string,\n    status: number | null = null,\n  ) {\n    super(message, status);\n  }\n}\n\nexport type GitHubAppInstallationSummary = {\n  installationId: number;\n  accountId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubSignedStatePayload = {\n  nonce: string;\n  iat: number;\n  accountId?: string;\n  workspaceId?: string;\n  [key: string]: unknown;\n};\n\nexport function githubAppMissingSettings(settings: Settings): string[] {\n  const required: Record<string, string | undefined> = {\n    OPENGENI_GITHUB_APP_ID: settings.githubAppId,\n    OPENGENI_GITHUB_CLIENT_ID: settings.githubClientId,\n    OPENGENI_GITHUB_CLIENT_SECRET: settings.githubClientSecret,\n    OPENGENI_GITHUB_APP_SLUG: settings.githubAppSlug,\n    OPENGENI_GITHUB_APP_PRIVATE_KEY: settings.githubAppPrivateKey,\n  };\n  return Object.entries(required).flatMap(([name, value]) => (value && value.trim() ? [] : [name]));\n}\n\nexport function buildGitHubAppManifest(input: {\n  appName: string;\n  baseUrl: string;\n  public: boolean;\n  includeCiPermissions: boolean;\n  setupUrl?: string;\n}): Record<string, unknown> {\n  const base = input.baseUrl.replace(/\\/+$/, \"\");\n  const permissions: Record<string, string> = {\n    metadata: \"read\",\n    contents: \"write\",\n    pull_requests: \"write\",\n    // Required for the authenticated-user membership endpoint that proves an\n    // active organization owner. Existing installations must approve this\n    // permission before organization-owner self-service can succeed.\n    members: \"read\",\n  };\n  if (input.includeCiPermissions) {\n    permissions.actions = \"read\";\n    permissions.checks = \"read\";\n    permissions.statuses = \"write\";\n  }\n  const manifest: Record<string, unknown> = {\n    name: input.appName,\n    url: base,\n    redirect_url: `${base}/v1/github/app-manifest/callback`,\n    callback_urls: [`${base}/v1/github/oauth/callback`],\n    public: input.public,\n    request_oauth_on_install: true,\n    default_permissions: permissions,\n  };\n  if (input.setupUrl) {\n    manifest.setup_url = input.setupUrl;\n    manifest.setup_on_update = true;\n  }\n  return manifest;\n}\n\nexport function personalAppManifestUrl(state: string): string {\n  return `https://github.com/settings/apps/new?state=${state}`;\n}\n\nexport function organizationAppManifestUrl(organization: string, state: string): string {\n  return `https://github.com/organizations/${encodeURIComponent(organization)}/settings/apps/new?state=${state}`;\n}\n\nexport function githubOAuthAuthorizeUrl(input: {\n  clientId: string;\n  state: string;\n  redirectUri?: string;\n}): string {\n  const url = new URL(\"https://github.com/login/oauth/authorize\");\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"state\", input.state);\n  if (input.redirectUri) {\n    url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  }\n  return url.toString();\n}\n\nexport function createSignedState(\n  secret: string,\n  payloadOrNow: Record<string, unknown> | number = {},\n  nowArg = Math.floor(Date.now() / 1000),\n): string {\n  const payloadInput = typeof payloadOrNow === \"number\" ? {} : payloadOrNow;\n  const now = typeof payloadOrNow === \"number\" ? payloadOrNow : nowArg;\n  const payload = {\n    ...payloadInput,\n    nonce: randomBytes(16).toString(\"base64url\"),\n    iat: now,\n  };\n  const encoded = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  return `${encoded}.${signStatePayload(encoded, secret)}`;\n}\n\nexport function readSignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): GitHubSignedStatePayload | null {\n  const [encoded, signature] = state.split(\".\", 2);\n  if (!encoded || !signature) {\n    return null;\n  }\n  const expected = signStatePayload(encoded, secret);\n  if (!safeEqual(signature, expected)) {\n    return null;\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return null;\n  }\n  if (\n    !payload ||\n    typeof payload !== \"object\" ||\n    typeof (payload as { iat?: unknown }).iat !== \"number\" ||\n    typeof (payload as { nonce?: unknown }).nonce !== \"string\"\n  ) {\n    return null;\n  }\n  const age = now - (payload as { iat: number }).iat;\n  return age >= 0 && age <= stateMaxAgeSeconds ? (payload as GitHubSignedStatePayload) : null;\n}\n\nexport function verifySignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): boolean {\n  return readSignedState(state, secret, now) !== null;\n}\n\nexport function envLinesFromGitHubManifestConversion(payload: Record<string, unknown>): string[] {\n  const privateKey = String(payload.pem ?? \"\").replace(/\\n/g, \"\\\\n\");\n  return [\n    `OPENGENI_GITHUB_APP_ID=${payload.id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_ID=${payload.client_id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_SECRET=${payload.client_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_SLUG=${payload.slug ?? \"\"}`,\n    `OPENGENI_GITHUB_WEBHOOK_SECRET=${payload.webhook_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_PRIVATE_KEY=\"${privateKey}\"`,\n  ];\n}\n\nexport async function convertGitHubAppManifest(code: string): Promise<Record<string, unknown>> {\n  const response = await fetch(`${githubApiBase}/app-manifests/${code}/conversions`, {\n    method: \"POST\",\n    headers: githubHeaders(undefined),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || Array.isArray(payload)) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid manifest conversion payload\");\n  }\n  return payload as Record<string, unknown>;\n}\n\nexport async function listGitHubAppInstallationSummaries(\n  settings: Settings,\n): Promise<GitHubAppInstallationSummary[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  return installations.map(installationSummaryFromPayload);\n}\n\nexport async function getGitHubAppInstallationSummary(\n  settings: Settings,\n  installationId: number,\n): Promise<GitHubAppInstallationSummary | null> {\n  const installations = await listGitHubAppInstallationSummaries(settings);\n  return (\n    installations.find((installation) => installation.installationId === installationId) ?? null\n  );\n}\n\nexport async function verifyGitHubInstallationAccessForUser(\n  settings: Settings,\n  input: {\n    code: string;\n    installationId: number;\n  },\n): Promise<GitHubAppInstallationSummary> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  const installation = installations.find(\n    (candidate) => candidate.installationId === input.installationId,\n  );\n  if (!installation) {\n    throw new GitHubAppApiError(\"GitHub installation is not accessible to the installing user\");\n  }\n  return installation;\n}\n\n/**\n * Exchange a GitHub App user-authorization code and discover the installations\n * and repositories the user can explicitly access. This is compatibility\n * discovery metadata only: visibility and repository permission bits do not\n * prove that the human may install, configure, or bind the App installation.\n * No production binding path may treat this result as authority.\n */\nexport async function authorizeGitHubAppUser(\n  settings: Settings,\n  input: { code: string },\n): Promise<GitHubUserInstallationAccess[]> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  return await Promise.all(\n    installations.map(async (installation) => ({\n      ...installation,\n      repositories: installation.suspended\n        ? []\n        : await listUserInstallationRepositories(token, installation),\n    })),\n  );\n}\n\n/**\n * Prove current GitHub installation authority without treating repository\n * administration or installation visibility as delegation authority.\n *\n * GitHub exposes an exact personal-account owner through the authenticated\n * user's immutable id. For organizations, GitHub's authenticated membership\n * endpoint exposes active owners as role=admin. GitHub does not expose an\n * equivalent current-authority receipt for App Managers, so that case remains\n * unsupported and fails closed.\n */\nexport async function authorizeGitHubInstallationBinding(\n  settings: Settings,\n  input: { code: string; installationId: number },\n): Promise<GitHubInstallationBindingProof> {\n  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const actor = await getAuthenticatedGitHubUser(userToken);\n  const visibleInstallations = await listUserAccessibleInstallations(userToken);\n  const visible = visibleInstallations.find(\n    (installation) => installation.installationId === input.installationId,\n  );\n  if (!visible) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"GitHub did not associate this installation with the authorized user\",\n    );\n  }\n\n  const jwt = await createGitHubAppJwt(settings);\n  const livePayload = (await listInstallations(jwt)).find(\n    (installation) => asInt(installation.id) === input.installationId,\n  );\n  if (!livePayload) {\n    throw new GitHubInstallationAuthorityError(\n      \"installation_missing\",\n      \"GitHub App installation was deleted or is not owned by this App\",\n    );\n  }\n  const installation = installationSummaryFromPayload(livePayload);\n  if (\n    installation.accountId !== visible.accountId ||\n    installation.accountLogin !== visible.accountLogin ||\n    installation.accountType !== visible.accountType\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"GitHub installation identity changed during authorization\",\n    );\n  }\n  if (installation.suspended) {\n    throw new GitHubInstallationAuthorityError(\n      \"installation_suspended\",\n      \"GitHub App installation is suspended\",\n    );\n  }\n\n  let authorityKind: GitHubInstallationBindingProof[\"authorityKind\"];\n  if (installation.accountType === \"User\" && actor.id === installation.accountId) {\n    authorityKind = \"personal_owner\";\n  } else if (installation.accountType === \"Organization\" && installation.accountLogin) {\n    await assertActiveOrganizationOwner(\n      userToken,\n      installation.accountId,\n      installation.accountLogin,\n    );\n    authorityKind = \"organization_owner\";\n  } else {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"Only a GitHub personal-account owner or organization owner may bind an installation\",\n    );\n  }\n\n  const installationToken = await createInstallationToken(jwt, {\n    installationId: installation.installationId,\n  });\n  const repositories = await listInstallationRepositories(\n    installationToken.token,\n    installation.installationId,\n    { login: installation.accountLogin, type: installation.accountType },\n  );\n  if (repositories.length === 0) {\n    throw new GitHubInstallationAuthorityError(\n      \"repository_access_empty\",\n      \"GitHub App installation does not currently grant access to any repositories\",\n    );\n  }\n  if (authorityKind === \"organization_owner\") {\n    // Repository enumeration is an async provider boundary. Re-read the live\n    // owner tuple after it so a role revoked after the chooser proof cannot be\n    // durably bound with a later, misleading authority timestamp.\n    await assertActiveOrganizationOwner(\n      userToken,\n      installation.accountId,\n      installation.accountLogin!,\n    );\n  }\n  return {\n    actorId: actor.id,\n    actorLogin: actor.login,\n    authorityKind,\n    installation,\n    repositories,\n  };\n}\n\nexport async function listGitHubAppRepositories(\n  settings: Settings,\n  input: {\n    installationIds?: number[];\n  } = {},\n): Promise<GitHubRepository[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const allowedInstallations = input.installationIds ? new Set(input.installationIds) : null;\n  if (allowedInstallations && allowedInstallations.size === 0) {\n    return [];\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  const repositories: GitHubRepository[] = [];\n  for (const installation of installations) {\n    if (installation.suspended_at) {\n      continue;\n    }\n    const installationId = asInt(installation.id);\n    if (installationId === null) {\n      continue;\n    }\n    if (allowedInstallations && !allowedInstallations.has(installationId)) {\n      continue;\n    }\n    const account =\n      typeof installation.account === \"object\" && installation.account\n        ? (installation.account as Record<string, unknown>)\n        : {};\n    const token = await createInstallationToken(jwt, { installationId });\n    repositories.push(\n      ...(await listInstallationRepositories(token.token, installationId, account)),\n    );\n  }\n  repositories.sort((left, right) => left.fullName.localeCompare(right.fullName));\n  return repositories;\n}\n\nexport async function createGitHubAppInstallationToken(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds: number[];\n  },\n): Promise<string> {\n  return (await createGitHubAppInstallationTokenWithExpiry(settings, input)).token;\n}\n\nexport type GitHubAppInstallationToken = {\n  token: string;\n  expiresAt: string | null;\n};\n\nexport async function createGitHubAppInstallationTokenWithExpiry(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  if (!Array.isArray(input.repositoryIds)) {\n    throw new GitHubAppApiError(\n      \"GitHub installation token mint requires an explicit, unique repository allowlist\",\n    );\n  }\n  const repositoryIds = [...new Set(input.repositoryIds)];\n  if (\n    !Number.isSafeInteger(input.installationId) ||\n    input.installationId <= 0 ||\n    repositoryIds.length === 0 ||\n    repositoryIds.length !== input.repositoryIds.length ||\n    repositoryIds.some((id) => !Number.isSafeInteger(id) || id <= 0)\n  ) {\n    throw new GitHubAppApiError(\n      \"GitHub installation token mint requires an explicit, unique repository allowlist\",\n    );\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  return await createInstallationToken(jwt, {\n    installationId: input.installationId,\n    repositoryIds,\n  });\n}\n\nexport function githubAppBotIdentity(settings: Settings): { name: string; email: string } | null {\n  const appId = settings.githubAppId?.trim();\n  const slug = settings.githubAppSlug?.trim();\n  if (!appId || !slug) {\n    return null;\n  }\n  const login = `${slug}[bot]`;\n  return {\n    name: login,\n    email: `${appId}+${login}@users.noreply.github.com`,\n  };\n}\n\nasync function createGitHubAppJwt(settings: Settings): Promise<string> {\n  const privateKey = normalizeGitHubAppPrivateKey(settings.githubAppPrivateKey ?? \"\");\n  const appId = settings.githubAppId?.trim();\n  if (!appId || !privateKey) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const key = await importPKCS8(privateKey, \"RS256\");\n  const now = Math.floor(Date.now() / 1000);\n  return await new SignJWT({})\n    .setProtectedHeader({ alg: \"RS256\" })\n    .setIssuedAt(now - 60)\n    .setExpirationTime(now + 9 * 60)\n    .setIssuer(appId)\n    .sign(key);\n}\n\nasync function listInstallations(token: string): Promise<Array<Record<string, unknown>>> {\n  const out: Array<Record<string, unknown>> = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/app/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (!Array.isArray(payload)) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid installations payload\");\n    }\n    out.push(\n      ...payload.filter((item): item is Record<string, unknown> =>\n        Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n      ),\n    );\n    if (payload.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function exchangeGitHubOAuthCodeForUserToken(\n  settings: Settings,\n  code: string,\n): Promise<string> {\n  if (!settings.githubClientId || !settings.githubClientSecret) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const response = await fetch(\"https://github.com/login/oauth/access_token\", {\n    method: \"POST\",\n    headers: {\n      Accept: \"application/json\",\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      client_id: settings.githubClientId,\n      client_secret: settings.githubClientSecret,\n      code,\n    }),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.access_token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid OAuth token payload\");\n  }\n  return payload.access_token;\n}\n\nasync function getAuthenticatedGitHubUser(token: string): Promise<{ id: number; login: string }> {\n  const payload = await githubGet(\"/user\", token);\n  const id = payload && typeof payload === \"object\" ? asInt(payload.id) : null;\n  const login =\n    payload && typeof payload === \"object\" && typeof payload.login === \"string\"\n      ? payload.login\n      : null;\n  if (id === null || !login) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid authenticated user payload\");\n  }\n  return { id, login };\n}\n\nasync function getAuthenticatedOrganizationMembership(\n  token: string,\n  organizationLogin: string,\n): Promise<{ organizationId: number; role: string; state: string }> {\n  let payload: any;\n  try {\n    payload = await githubGet(\n      `/user/memberships/orgs/${encodeURIComponent(organizationLogin)}`,\n      token,\n    );\n  } catch (error) {\n    if (error instanceof GitHubAppApiError) {\n      throw new GitHubInstallationAuthorityError(\n        \"authority_unavailable\",\n        \"GitHub could not prove current organization-owner membership\",\n        error.status,\n      );\n    }\n    throw error;\n  }\n  const organization =\n    payload && typeof payload === \"object\" && payload.organization ? payload.organization : null;\n  const organizationId =\n    organization && typeof organization === \"object\" ? asInt(organization.id) : null;\n  if (\n    organizationId === null ||\n    typeof payload?.role !== \"string\" ||\n    typeof payload?.state !== \"string\"\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_unavailable\",\n      \"GitHub returned an invalid organization membership proof\",\n    );\n  }\n  return { organizationId, role: payload.role, state: payload.state };\n}\n\nasync function assertActiveOrganizationOwner(\n  token: string,\n  organizationId: number,\n  organizationLogin: string,\n): Promise<void> {\n  const membership = await getAuthenticatedOrganizationMembership(token, organizationLogin);\n  if (\n    membership.organizationId !== organizationId ||\n    membership.state !== \"active\" ||\n    membership.role !== \"admin\"\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"Only an active GitHub organization owner may bind this installation\",\n    );\n  }\n}\n\nasync function listUserAccessibleInstallations(\n  token: string,\n): Promise<GitHubAppInstallationSummary[]> {\n  const out: GitHubAppInstallationSummary[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/user/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    const installations: unknown[] | null =\n      payload && typeof payload === \"object\" && Array.isArray(payload.installations)\n        ? (payload.installations as unknown[])\n        : null;\n    if (!installations) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid user installations payload\");\n    }\n    out.push(\n      ...installations\n        .filter((item): item is Record<string, unknown> =>\n          Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n        )\n        .map(installationSummaryFromPayload),\n    );\n    if (installations.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function listUserInstallationRepositories(\n  token: string,\n  installation: GitHubAppInstallationSummary,\n): Promise<GitHubUserRepositoryAccess[]> {\n  const out: GitHubUserRepositoryAccess[] = [];\n  const account = {\n    ...(installation.accountLogin ? { login: installation.accountLogin } : {}),\n    ...(installation.accountType ? { type: installation.accountType } : {}),\n  };\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\n      `/user/installations/${installation.installationId}/repositories`,\n      token,\n      { per_page: \"100\", page: String(page) },\n    );\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\n        \"GitHub returned an invalid user installation repositories payload\",\n      );\n    }\n    for (const repository of payload.repositories) {\n      if (!repository || typeof repository !== \"object\" || Array.isArray(repository)) {\n        continue;\n      }\n      const record = repository as Record<string, unknown>;\n      out.push({\n        ...repositoryFromPayload(record, installation.installationId, account),\n        permissions: repositoryPermissionsFromPayload(record.permissions),\n      });\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function createInstallationToken(\n  appJwt: string,\n  input: {\n    installationId: number;\n    repositoryIds?: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const scoped = input.repositoryIds && input.repositoryIds.length > 0;\n  const response = await fetch(\n    `${githubApiBase}/app/installations/${input.installationId}/access_tokens`,\n    {\n      method: \"POST\",\n      headers: {\n        ...githubHeaders(appJwt),\n        ...(scoped ? { \"Content-Type\": \"application/json\" } : {}),\n      },\n      signal: AbortSignal.timeout(githubTokenMintTimeoutMs),\n      ...(scoped ? { body: JSON.stringify({ repository_ids: input.repositoryIds }) } : {}),\n    },\n  );\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid installation token payload\");\n  }\n  return {\n    token: payload.token,\n    expiresAt: typeof payload.expires_at === \"string\" ? payload.expires_at : null,\n  };\n}\n\nasync function listInstallationRepositories(\n  token: string,\n  installationId: number,\n  account: Record<string, unknown>,\n): Promise<GitHubRepository[]> {\n  const out: GitHubRepository[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/installation/repositories\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid repositories payload\");\n    }\n    for (const repo of payload.repositories) {\n      if (repo && typeof repo === \"object\" && !Array.isArray(repo)) {\n        out.push(repositoryFromPayload(repo as Record<string, unknown>, installationId, account));\n      }\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nfunction installationSummaryFromPayload(\n  payload: Record<string, unknown>,\n): GitHubAppInstallationSummary {\n  const installationId = asInt(payload.id);\n  if (installationId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without id\");\n  }\n  const account =\n    typeof payload.account === \"object\" && payload.account\n      ? (payload.account as Record<string, unknown>)\n      : {};\n  const accountId = asInt(account.id);\n  if (accountId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without an account id\");\n  }\n  return {\n    installationId,\n    accountId,\n    accountLogin: typeof account.login === \"string\" ? account.login : null,\n    accountType: typeof account.type === \"string\" ? account.type : null,\n    suspended: Boolean(payload.suspended_at),\n  };\n}\n\nasync function githubGet(\n  path: string,\n  token: string,\n  params: Record<string, string> = {},\n): Promise<any> {\n  const url = new URL(`${githubApiBase}${path}`);\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, value);\n  }\n  const response = await fetch(url, { headers: githubHeaders(token) });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response), response.status);\n  }\n  return await response.json();\n}\n\nfunction repositoryFromPayload(\n  payload: Record<string, unknown>,\n  installationId: number,\n  account: Record<string, unknown>,\n): GitHubRepository {\n  const id = asInt(payload.id);\n  const fullName = String(payload.full_name ?? \"\");\n  if (id === null || !fullName) {\n    throw new GitHubAppApiError(\"GitHub returned a repository without id/full_name\");\n  }\n  return {\n    id,\n    installationId,\n    fullName,\n    name: String(payload.name ?? fullName.split(\"/\").at(-1) ?? fullName),\n    private: Boolean(payload.private),\n    htmlUrl: String(payload.html_url ?? `https://github.com/${fullName}`),\n    cloneUrl: String(payload.clone_url ?? `https://github.com/${fullName}.git`),\n    defaultBranch: String(payload.default_branch ?? \"main\"),\n    accountLogin: String(account.login ?? fullName.split(\"/\", 1)[0]),\n    accountType: typeof account.type === \"string\" ? account.type : null,\n  };\n}\n\nfunction repositoryPermissionsFromPayload(payload: unknown): GitHubRepositoryPermissions {\n  const permissions =\n    payload && typeof payload === \"object\" && !Array.isArray(payload)\n      ? (payload as Record<string, unknown>)\n      : {};\n  return {\n    admin: permissions.admin === true,\n    maintain: permissions.maintain === true,\n    push: permissions.push === true,\n    triage: permissions.triage === true,\n    pull: permissions.pull === true,\n  };\n}\n\nfunction githubHeaders(token?: string): HeadersInit {\n  return {\n    Accept: \"application/vnd.github+json\",\n    ...(token ? { Authorization: `Bearer ${token}` } : {}),\n    \"X-GitHub-Api-Version\": githubApiVersion,\n  };\n}\n\nasync function githubErrorMessage(response: Response): Promise<string> {\n  try {\n    const payload = await response.json();\n    if (payload && typeof payload === \"object\" && \"message\" in payload) {\n      return `GitHub API ${response.status}: ${String(payload.message)}`;\n    }\n  } catch {\n    // fall through\n  }\n  return `GitHub API ${response.status}: ${await response.text()}`;\n}\n\nexport function normalizeGitHubAppPrivateKey(value: string): string {\n  const privateKey = value.trim().replace(/\\\\n/g, \"\\n\");\n  if (!privateKey || privateKey.startsWith(pkcs8PrivateKeyHeader)) {\n    return privateKey;\n  }\n  if (privateKey.startsWith(rsaPrivateKeyHeader)) {\n    return createPrivateKey(privateKey).export({ type: \"pkcs8\", format: \"pem\" }).toString();\n  }\n  return privateKey;\n}\n\nfunction signStatePayload(encoded: string, secret: string): string {\n  return createHmac(\"sha256\", secret).update(encoded).digest(\"base64url\");\n}\n\nfunction safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction asInt(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value)) {\n    return value;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) {\n    return Number(value);\n  }\n  return null;\n}\n"],"mappings":";AAQA,SAAS,YAAY,kBAAkB,aAAa,uBAAuB;AAC3E,SAAS,SAAS,mBAAmB;AAErC,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,2BAA2B;AAC1B,IAAM,qBAAqB,KAAK;AACvC,IAAM,wBAAwB,cAAc,aAAa;AACzD,IAAM,sBAAsB,cAAc,iBAAiB;AAEpD,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAqB,SAAmB;AACtC,UAAM,8BAA8B;AADjB;AAAA,EAErB;AACF;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YACE,SACS,SAAwB,MACjC;AACA,UAAM,OAAO;AAFJ;AAAA,EAGX;AACF;AASO,IAAM,mCAAN,cAA+C,kBAAkB;AAAA,EACtE,YACW,QACT,SACA,SAAwB,MACxB;AACA,UAAM,SAAS,MAAM;AAJZ;AAAA,EAKX;AACF;AAkBO,SAAS,yBAAyB,UAA8B;AACrE,QAAM,WAA+C;AAAA,IACnD,wBAAwB,SAAS;AAAA,IACjC,2BAA2B,SAAS;AAAA,IACpC,+BAA+B,SAAS;AAAA,IACxC,0BAA0B,SAAS;AAAA,IACnC,iCAAiC,SAAS;AAAA,EAC5C;AACA,SAAO,OAAO,QAAQ,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAO,SAAS,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE;AAClG;AAEO,SAAS,uBAAuB,OAMX;AAC1B,QAAM,OAAO,MAAM,QAAQ,QAAQ,QAAQ,EAAE;AAC7C,QAAM,cAAsC;AAAA,IAC1C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,eAAe;AAAA;AAAA;AAAA;AAAA,IAIf,SAAS;AAAA,EACX;AACA,MAAI,MAAM,sBAAsB;AAC9B,gBAAY,UAAU;AACtB,gBAAY,SAAS;AACrB,gBAAY,WAAW;AAAA,EACzB;AACA,QAAM,WAAoC;AAAA,IACxC,MAAM,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,cAAc,GAAG,IAAI;AAAA,IACrB,eAAe,CAAC,GAAG,IAAI,2BAA2B;AAAA,IAClD,QAAQ,MAAM;AAAA,IACd,0BAA0B;AAAA,IAC1B,qBAAqB;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,aAAS,YAAY,MAAM;AAC3B,aAAS,kBAAkB;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAuB;AAC5D,SAAO,8CAA8C,KAAK;AAC5D;AAEO,SAAS,2BAA2B,cAAsB,OAAuB;AACtF,SAAO,oCAAoC,mBAAmB,YAAY,CAAC,4BAA4B,KAAK;AAC9G;AAEO,SAAS,wBAAwB,OAI7B;AACT,QAAM,MAAM,IAAI,IAAI,0CAA0C;AAC9D,MAAI,aAAa,IAAI,aAAa,MAAM,QAAQ;AAChD,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,MAAI,MAAM,aAAa;AACrB,QAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;AAAA,EACxD;AACA,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,kBACd,QACA,eAAiD,CAAC,GAClD,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC7B;AACR,QAAM,eAAe,OAAO,iBAAiB,WAAW,CAAC,IAAI;AAC7D,QAAM,MAAM,OAAO,iBAAiB,WAAW,eAAe;AAC9D,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,IAC3C,KAAK;AAAA,EACP;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AACzE,SAAO,GAAG,OAAO,IAAI,iBAAiB,SAAS,MAAM,CAAC;AACxD;AAEO,SAAS,gBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACD;AACjC,QAAM,CAAC,SAAS,SAAS,IAAI,MAAM,MAAM,KAAK,CAAC;AAC/C,MAAI,CAAC,WAAW,CAAC,WAAW;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,iBAAiB,SAAS,MAAM;AACjD,MAAI,CAAC,UAAU,WAAW,QAAQ,GAAG;AACnC,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,CAAC,WACD,OAAO,YAAY,YACnB,OAAQ,QAA8B,QAAQ,YAC9C,OAAQ,QAAgC,UAAU,UAClD;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAO,QAA4B;AAC/C,SAAO,OAAO,KAAK,OAAO,qBAAsB,UAAuC;AACzF;AAEO,SAAS,kBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACzB;AACT,SAAO,gBAAgB,OAAO,QAAQ,GAAG,MAAM;AACjD;AAEO,SAAS,qCAAqC,SAA4C;AAC/F,QAAM,aAAa,OAAO,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,KAAK;AACjE,SAAO;AAAA,IACL,0BAA0B,QAAQ,MAAM,EAAE;AAAA,IAC1C,6BAA6B,QAAQ,aAAa,EAAE;AAAA,IACpD,iCAAiC,QAAQ,iBAAiB,EAAE;AAAA,IAC5D,4BAA4B,QAAQ,QAAQ,EAAE;AAAA,IAC9C,kCAAkC,QAAQ,kBAAkB,EAAE;AAAA,IAC9D,oCAAoC,UAAU;AAAA,EAChD;AACF;AAEA,eAAsB,yBAAyB,MAAgD;AAC7F,QAAM,WAAW,MAAM,MAAM,GAAG,aAAa,kBAAkB,IAAI,gBAAgB;AAAA,IACjF,QAAQ;AAAA,IACR,SAAS,cAAc,MAAS;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,UAAM,IAAI,kBAAkB,wDAAwD;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,mCACpB,UACyC;AACzC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,SAAO,cAAc,IAAI,8BAA8B;AACzD;AAEA,eAAsB,gCACpB,UACA,gBAC8C;AAC9C,QAAM,gBAAgB,MAAM,mCAAmC,QAAQ;AACvE,SACE,cAAc,KAAK,CAAC,iBAAiB,aAAa,mBAAmB,cAAc,KAAK;AAE5F;AAEA,eAAsB,sCACpB,UACA,OAIuC;AACvC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,QAAM,eAAe,cAAc;AAAA,IACjC,CAAC,cAAc,UAAU,mBAAmB,MAAM;AAAA,EACpD;AACA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,kBAAkB,8DAA8D;AAAA,EAC5F;AACA,SAAO;AACT;AASA,eAAsB,uBACpB,UACA,OACyC;AACzC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,SAAO,MAAM,QAAQ;AAAA,IACnB,cAAc,IAAI,OAAO,kBAAkB;AAAA,MACzC,GAAG;AAAA,MACH,cAAc,aAAa,YACvB,CAAC,IACD,MAAM,iCAAiC,OAAO,YAAY;AAAA,IAChE,EAAE;AAAA,EACJ;AACF;AAYA,eAAsB,mCACpB,UACA,OACyC;AACzC,QAAM,YAAY,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAChF,QAAM,QAAQ,MAAM,2BAA2B,SAAS;AACxD,QAAM,uBAAuB,MAAM,gCAAgC,SAAS;AAC5E,QAAM,UAAU,qBAAqB;AAAA,IACnC,CAACA,kBAAiBA,cAAa,mBAAmB,MAAM;AAAA,EAC1D;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,eAAe,MAAM,kBAAkB,GAAG,GAAG;AAAA,IACjD,CAACA,kBAAiB,MAAMA,cAAa,EAAE,MAAM,MAAM;AAAA,EACrD;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,+BAA+B,WAAW;AAC/D,MACE,aAAa,cAAc,QAAQ,aACnC,aAAa,iBAAiB,QAAQ,gBACtC,aAAa,gBAAgB,QAAQ,aACrC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,aAAa,WAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,aAAa,gBAAgB,UAAU,MAAM,OAAO,aAAa,WAAW;AAC9E,oBAAgB;AAAA,EAClB,WAAW,aAAa,gBAAgB,kBAAkB,aAAa,cAAc;AACnF,UAAM;AAAA,MACJ;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AACA,oBAAgB;AAAA,EAClB,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,MAAM,wBAAwB,KAAK;AAAA,IAC3D,gBAAgB,aAAa;AAAA,EAC/B,CAAC;AACD,QAAM,eAAe,MAAM;AAAA,IACzB,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,EAAE,OAAO,aAAa,cAAc,MAAM,aAAa,YAAY;AAAA,EACrE;AACA,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,sBAAsB;AAI1C,UAAM;AAAA,MACJ;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,UACA,QAEI,CAAC,GACwB;AAC7B,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,uBAAuB,MAAM,kBAAkB,IAAI,IAAI,MAAM,eAAe,IAAI;AACtF,MAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC3D,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,QAAM,eAAmC,CAAC;AAC1C,aAAW,gBAAgB,eAAe;AACxC,QAAI,aAAa,cAAc;AAC7B;AAAA,IACF;AACA,UAAM,iBAAiB,MAAM,aAAa,EAAE;AAC5C,QAAI,mBAAmB,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,wBAAwB,CAAC,qBAAqB,IAAI,cAAc,GAAG;AACrE;AAAA,IACF;AACA,UAAM,UACJ,OAAO,aAAa,YAAY,YAAY,aAAa,UACpD,aAAa,UACd,CAAC;AACP,UAAM,QAAQ,MAAM,wBAAwB,KAAK,EAAE,eAAe,CAAC;AACnE,iBAAa;AAAA,MACX,GAAI,MAAM,6BAA6B,MAAM,OAAO,gBAAgB,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,eAAa,KAAK,CAAC,MAAM,UAAU,KAAK,SAAS,cAAc,MAAM,QAAQ,CAAC;AAC9E,SAAO;AACT;AAEA,eAAsB,iCACpB,UACA,OAIiB;AACjB,UAAQ,MAAM,2CAA2C,UAAU,KAAK,GAAG;AAC7E;AAOA,eAAsB,2CACpB,UACA,OAIqC;AACrC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,aAAa,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,MAAM,aAAa,CAAC;AACtD,MACE,CAAC,OAAO,cAAc,MAAM,cAAc,KAC1C,MAAM,kBAAkB,KACxB,cAAc,WAAW,KACzB,cAAc,WAAW,MAAM,cAAc,UAC7C,cAAc,KAAK,CAAC,OAAO,CAAC,OAAO,cAAc,EAAE,KAAK,MAAM,CAAC,GAC/D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,SAAO,MAAM,wBAAwB,KAAK;AAAA,IACxC,gBAAgB,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qBAAqB,UAA4D;AAC/F,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,QAAM,OAAO,SAAS,eAAe,KAAK;AAC1C,MAAI,CAAC,SAAS,CAAC,MAAM;AACnB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,GAAG,IAAI;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,GAAG,KAAK,IAAI,KAAK;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,QAAM,aAAa,6BAA6B,SAAS,uBAAuB,EAAE;AAClF,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,MAAI,CAAC,SAAS,CAAC,YAAY;AACzB,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,MAAM,MAAM,YAAY,YAAY,OAAO;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,EACxB,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,MAAM,EAAE,EACpB,kBAAkB,MAAM,IAAI,EAAE,EAC9B,UAAU,KAAK,EACf,KAAK,GAAG;AACb;AAEA,eAAe,kBAAkB,OAAwD;AACvF,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,sBAAsB,OAAO;AAAA,MAC3D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,YAAM,IAAI,kBAAkB,kDAAkD;AAAA,IAChF;AACA,QAAI;AAAA,MACF,GAAG,QAAQ;AAAA,QAAO,CAAC,SACjB,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,oCACb,UACA,MACiB;AACjB,MAAI,CAAC,SAAS,kBAAkB,CAAC,SAAS,oBAAoB;AAC5D,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,WAAW,MAAM,MAAM,+CAA+C;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,eAAe,SAAS;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,iBAAiB,UAAU;AACvF,UAAM,IAAI,kBAAkB,gDAAgD;AAAA,EAC9E;AACA,SAAO,QAAQ;AACjB;AAEA,eAAe,2BAA2B,OAAuD;AAC/F,QAAM,UAAU,MAAM,UAAU,SAAS,KAAK;AAC9C,QAAM,KAAK,WAAW,OAAO,YAAY,WAAW,MAAM,QAAQ,EAAE,IAAI;AACxE,QAAM,QACJ,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,WAC/D,QAAQ,QACR;AACN,MAAI,OAAO,QAAQ,CAAC,OAAO;AACzB,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO,EAAE,IAAI,MAAM;AACrB;AAEA,eAAe,uCACb,OACA,mBACkE;AAClE,MAAI;AACJ,MAAI;AACF,cAAU,MAAM;AAAA,MACd,0BAA0B,mBAAmB,iBAAiB,CAAC;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAmB;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,eACJ,WAAW,OAAO,YAAY,YAAY,QAAQ,eAAe,QAAQ,eAAe;AAC1F,QAAM,iBACJ,gBAAgB,OAAO,iBAAiB,WAAW,MAAM,aAAa,EAAE,IAAI;AAC9E,MACE,mBAAmB,QACnB,OAAO,SAAS,SAAS,YACzB,OAAO,SAAS,UAAU,UAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,gBAAgB,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM;AACpE;AAEA,eAAe,8BACb,OACA,gBACA,mBACe;AACf,QAAM,aAAa,MAAM,uCAAuC,OAAO,iBAAiB;AACxF,MACE,WAAW,mBAAmB,kBAC9B,WAAW,UAAU,YACrB,WAAW,SAAS,SACpB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gCACb,OACyC;AACzC,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,uBAAuB,OAAO;AAAA,MAC5D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,UAAM,gBACJ,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,QAAQ,aAAa,IACxE,QAAQ,gBACT;AACN,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,kBAAkB,uDAAuD;AAAA,IACrF;AACA,QAAI;AAAA,MACF,GAAG,cACA;AAAA,QAAO,CAAC,SACP,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE,EACC,IAAI,8BAA8B;AAAA,IACvC;AACA,QAAI,cAAc,SAAS,KAAK;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,iCACb,OACA,cACuC;AACvC,QAAM,MAAoC,CAAC;AAC3C,QAAM,UAAU;AAAA,IACd,GAAI,aAAa,eAAe,EAAE,OAAO,aAAa,aAAa,IAAI,CAAC;AAAA,IACxE,GAAI,aAAa,cAAc,EAAE,MAAM,aAAa,YAAY,IAAI,CAAC;AAAA,EACvE;AACA,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM;AAAA,MACpB,uBAAuB,aAAa,cAAc;AAAA,MAClD;AAAA,MACA,EAAE,UAAU,OAAO,MAAM,OAAO,IAAI,EAAE;AAAA,IACxC;AACA,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,eAAW,cAAc,QAAQ,cAAc;AAC7C,UAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AAC9E;AAAA,MACF;AACA,YAAM,SAAS;AACf,UAAI,KAAK;AAAA,QACP,GAAG,sBAAsB,QAAQ,aAAa,gBAAgB,OAAO;AAAA,QACrE,aAAa,iCAAiC,OAAO,WAAW;AAAA,MAClE,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,wBACb,QACA,OAIqC;AACrC,QAAM,SAAS,MAAM,iBAAiB,MAAM,cAAc,SAAS;AACnE,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,aAAa,sBAAsB,MAAM,cAAc;AAAA,IAC1D;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,GAAG,cAAc,MAAM;AAAA,QACvB,GAAI,SAAS,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,MACzD;AAAA,MACA,QAAQ,YAAY,QAAQ,wBAAwB;AAAA,MACpD,GAAI,SAAS,EAAE,MAAM,KAAK,UAAU,EAAE,gBAAgB,MAAM,cAAc,CAAC,EAAE,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,UAAU;AAChF,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,WAAW,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,EAC3E;AACF;AAEA,eAAe,6BACb,OACA,gBACA,SAC6B;AAC7B,QAAM,MAA0B,CAAC;AACjC,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,8BAA8B,OAAO;AAAA,MACnE,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI,kBAAkB,iDAAiD;AAAA,IAC/E;AACA,eAAW,QAAQ,QAAQ,cAAc;AACvC,UAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AAC5D,YAAI,KAAK,sBAAsB,MAAiC,gBAAgB,OAAO,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,+BACP,SAC8B;AAC9B,QAAM,iBAAiB,MAAM,QAAQ,EAAE;AACvC,MAAI,mBAAmB,MAAM;AAC3B,UAAM,IAAI,kBAAkB,4CAA4C;AAAA,EAC1E;AACA,QAAM,UACJ,OAAO,QAAQ,YAAY,YAAY,QAAQ,UAC1C,QAAQ,UACT,CAAC;AACP,QAAM,YAAY,MAAM,QAAQ,EAAE;AAClC,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAClE,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IAC/D,WAAW,QAAQ,QAAQ,YAAY;AAAA,EACzC;AACF;AAEA,eAAe,UACb,MACA,OACA,SAAiC,CAAC,GACpB;AACd,QAAM,MAAM,IAAI,IAAI,GAAG,aAAa,GAAG,IAAI,EAAE;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AACnE,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,GAAG,SAAS,MAAM;AAAA,EACjF;AACA,SAAO,MAAM,SAAS,KAAK;AAC7B;AAEA,SAAS,sBACP,SACA,gBACA,SACkB;AAClB,QAAM,KAAK,MAAM,QAAQ,EAAE;AAC3B,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAC/C,MAAI,OAAO,QAAQ,CAAC,UAAU;AAC5B,UAAM,IAAI,kBAAkB,mDAAmD;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,QAAQ,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,QAAQ;AAAA,IACnE,SAAS,QAAQ,QAAQ,OAAO;AAAA,IAChC,SAAS,OAAO,QAAQ,YAAY,sBAAsB,QAAQ,EAAE;AAAA,IACpE,UAAU,OAAO,QAAQ,aAAa,sBAAsB,QAAQ,MAAM;AAAA,IAC1E,eAAe,OAAO,QAAQ,kBAAkB,MAAM;AAAA,IACtD,cAAc,OAAO,QAAQ,SAAS,SAAS,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,IAC/D,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,EACjE;AACF;AAEA,SAAS,iCAAiC,SAA+C;AACvF,QAAM,cACJ,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3D,UACD,CAAC;AACP,SAAO;AAAA,IACL,OAAO,YAAY,UAAU;AAAA,IAC7B,UAAU,YAAY,aAAa;AAAA,IACnC,MAAM,YAAY,SAAS;AAAA,IAC3B,QAAQ,YAAY,WAAW;AAAA,IAC/B,MAAM,YAAY,SAAS;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,OAA6B;AAClD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,GAAI,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AAAA,IACpD,wBAAwB;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,MAAI;AACF,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,QAAI,WAAW,OAAO,YAAY,YAAY,aAAa,SAAS;AAClE,aAAO,cAAc,SAAS,MAAM,KAAK,OAAO,QAAQ,OAAO,CAAC;AAAA,IAClE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,cAAc,SAAS,MAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAChE;AAEO,SAAS,6BAA6B,OAAuB;AAClE,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,QAAQ,IAAI;AACpD,MAAI,CAAC,cAAc,WAAW,WAAW,qBAAqB,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,MAAI,WAAW,WAAW,mBAAmB,GAAG;AAC9C,WAAO,iBAAiB,UAAU,EAAE,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,QAAwB;AACjE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW;AACxE;AAEA,SAAS,UAAU,MAAc,OAAwB;AACvD,QAAM,IAAI,OAAO,KAAK,IAAI;AAC1B,QAAM,IAAI,OAAO,KAAK,KAAK;AAC3B,SAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAEA,SAAS,MAAM,OAA+B;AAC5C,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,GAAG;AACpD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;","names":["installation"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/github",
-  "version": "0.3.12",
+  "version": "0.3.18",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -31,8 +31,8 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/config": "^0.7.0",
-    "@opengeni/contracts": "^0.19.0",
+    "@opengeni/config": "^0.7.6",
+    "@opengeni/contracts": "^0.19.4",
     "jose": "^6.1.3"
   }
 }

package/src/index.ts

@@ -1,5 +1,6 @@
 import type { Settings } from "@opengeni/config";
 import type {
+  GitHubInstallationBindingProof,
   GitHubRepository,
   GitHubRepositoryPermissions,
   GitHubUserInstallationAccess,
@@ -21,10 +22,35 @@ export class GitHubAppConfigurationError extends Error {
   }
 }
 
-export class GitHubAppApiError extends Error {}
+export class GitHubAppApiError extends Error {
+  constructor(
+    message: string,
+    readonly status: number | null = null,
+  ) {
+    super(message);
+  }
+}
+
+export type GitHubInstallationAuthorityFailure =
+  | "authority_denied"
+  | "authority_unavailable"
+  | "installation_missing"
+  | "installation_suspended"
+  | "repository_access_empty";
+
+export class GitHubInstallationAuthorityError extends GitHubAppApiError {
+  constructor(
+    readonly reason: GitHubInstallationAuthorityFailure,
+    message: string,
+    status: number | null = null,
+  ) {
+    super(message, status);
+  }
+}
 
 export type GitHubAppInstallationSummary = {
   installationId: number;
+  accountId: number;
   accountLogin: string | null;
   accountType: string | null;
   suspended: boolean;
@@ -61,6 +87,10 @@ export function buildGitHubAppManifest(input: {
     metadata: "read",
     contents: "write",
     pull_requests: "write",
+    // Required for the authenticated-user membership endpoint that proves an
+    // active organization owner. Existing installations must approve this
+    // permission before organization-owner self-service can succeed.
+    members: "read",
   };
   if (input.includeCiPermissions) {
     permissions.actions = "read";
@@ -250,6 +280,111 @@ export async function authorizeGitHubAppUser(
   );
 }
 
+/**
+ * Prove current GitHub installation authority without treating repository
+ * administration or installation visibility as delegation authority.
+ *
+ * GitHub exposes an exact personal-account owner through the authenticated
+ * user's immutable id. For organizations, GitHub's authenticated membership
+ * endpoint exposes active owners as role=admin. GitHub does not expose an
+ * equivalent current-authority receipt for App Managers, so that case remains
+ * unsupported and fails closed.
+ */
+export async function authorizeGitHubInstallationBinding(
+  settings: Settings,
+  input: { code: string; installationId: number },
+): Promise<GitHubInstallationBindingProof> {
+  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);
+  const actor = await getAuthenticatedGitHubUser(userToken);
+  const visibleInstallations = await listUserAccessibleInstallations(userToken);
+  const visible = visibleInstallations.find(
+    (installation) => installation.installationId === input.installationId,
+  );
+  if (!visible) {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "GitHub did not associate this installation with the authorized user",
+    );
+  }
+
+  const jwt = await createGitHubAppJwt(settings);
+  const livePayload = (await listInstallations(jwt)).find(
+    (installation) => asInt(installation.id) === input.installationId,
+  );
+  if (!livePayload) {
+    throw new GitHubInstallationAuthorityError(
+      "installation_missing",
+      "GitHub App installation was deleted or is not owned by this App",
+    );
+  }
+  const installation = installationSummaryFromPayload(livePayload);
+  if (
+    installation.accountId !== visible.accountId ||
+    installation.accountLogin !== visible.accountLogin ||
+    installation.accountType !== visible.accountType
+  ) {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "GitHub installation identity changed during authorization",
+    );
+  }
+  if (installation.suspended) {
+    throw new GitHubInstallationAuthorityError(
+      "installation_suspended",
+      "GitHub App installation is suspended",
+    );
+  }
+
+  let authorityKind: GitHubInstallationBindingProof["authorityKind"];
+  if (installation.accountType === "User" && actor.id === installation.accountId) {
+    authorityKind = "personal_owner";
+  } else if (installation.accountType === "Organization" && installation.accountLogin) {
+    await assertActiveOrganizationOwner(
+      userToken,
+      installation.accountId,
+      installation.accountLogin,
+    );
+    authorityKind = "organization_owner";
+  } else {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "Only a GitHub personal-account owner or organization owner may bind an installation",
+    );
+  }
+
+  const installationToken = await createInstallationToken(jwt, {
+    installationId: installation.installationId,
+  });
+  const repositories = await listInstallationRepositories(
+    installationToken.token,
+    installation.installationId,
+    { login: installation.accountLogin, type: installation.accountType },
+  );
+  if (repositories.length === 0) {
+    throw new GitHubInstallationAuthorityError(
+      "repository_access_empty",
+      "GitHub App installation does not currently grant access to any repositories",
+    );
+  }
+  if (authorityKind === "organization_owner") {
+    // Repository enumeration is an async provider boundary. Re-read the live
+    // owner tuple after it so a role revoked after the chooser proof cannot be
+    // durably bound with a later, misleading authority timestamp.
+    await assertActiveOrganizationOwner(
+      userToken,
+      installation.accountId,
+      installation.accountLogin!,
+    );
+  }
+  return {
+    actorId: actor.id,
+    actorLogin: actor.login,
+    authorityKind,
+    installation,
+    repositories,
+  };
+}
+
 export async function listGitHubAppRepositories(
   settings: Settings,
   input: {
@@ -295,7 +430,7 @@ export async function createGitHubAppInstallationToken(
   settings: Settings,
   input: {
     installationId: number;
-    repositoryIds?: number[];
+    repositoryIds: number[];
   },
 ): Promise<string> {
   return (await createGitHubAppInstallationTokenWithExpiry(settings, input)).token;
@@ -310,15 +445,35 @@ export async function createGitHubAppInstallationTokenWithExpiry(
   settings: Settings,
   input: {
     installationId: number;
-    repositoryIds?: number[];
+    repositoryIds: number[];
   },
 ): Promise<GitHubAppInstallationToken> {
   const missing = githubAppMissingSettings(settings);
   if (missing.length > 0) {
     throw new GitHubAppConfigurationError(missing);
   }
+  if (!Array.isArray(input.repositoryIds)) {
+    throw new GitHubAppApiError(
+      "GitHub installation token mint requires an explicit, unique repository allowlist",
+    );
+  }
+  const repositoryIds = [...new Set(input.repositoryIds)];
+  if (
+    !Number.isSafeInteger(input.installationId) ||
+    input.installationId <= 0 ||
+    repositoryIds.length === 0 ||
+    repositoryIds.length !== input.repositoryIds.length ||
+    repositoryIds.some((id) => !Number.isSafeInteger(id) || id <= 0)
+  ) {
+    throw new GitHubAppApiError(
+      "GitHub installation token mint requires an explicit, unique repository allowlist",
+    );
+  }
   const jwt = await createGitHubAppJwt(settings);
-  return await createInstallationToken(jwt, input);
+  return await createInstallationToken(jwt, {
+    installationId: input.installationId,
+    repositoryIds,
+  });
 }
 
 export function githubAppBotIdentity(settings: Settings): { name: string; email: string } | null {
@@ -400,6 +555,74 @@ async function exchangeGitHubOAuthCodeForUserToken(
   return payload.access_token;
 }
 
+async function getAuthenticatedGitHubUser(token: string): Promise<{ id: number; login: string }> {
+  const payload = await githubGet("/user", token);
+  const id = payload && typeof payload === "object" ? asInt(payload.id) : null;
+  const login =
+    payload && typeof payload === "object" && typeof payload.login === "string"
+      ? payload.login
+      : null;
+  if (id === null || !login) {
+    throw new GitHubAppApiError("GitHub returned an invalid authenticated user payload");
+  }
+  return { id, login };
+}
+
+async function getAuthenticatedOrganizationMembership(
+  token: string,
+  organizationLogin: string,
+): Promise<{ organizationId: number; role: string; state: string }> {
+  let payload: any;
+  try {
+    payload = await githubGet(
+      `/user/memberships/orgs/${encodeURIComponent(organizationLogin)}`,
+      token,
+    );
+  } catch (error) {
+    if (error instanceof GitHubAppApiError) {
+      throw new GitHubInstallationAuthorityError(
+        "authority_unavailable",
+        "GitHub could not prove current organization-owner membership",
+        error.status,
+      );
+    }
+    throw error;
+  }
+  const organization =
+    payload && typeof payload === "object" && payload.organization ? payload.organization : null;
+  const organizationId =
+    organization && typeof organization === "object" ? asInt(organization.id) : null;
+  if (
+    organizationId === null ||
+    typeof payload?.role !== "string" ||
+    typeof payload?.state !== "string"
+  ) {
+    throw new GitHubInstallationAuthorityError(
+      "authority_unavailable",
+      "GitHub returned an invalid organization membership proof",
+    );
+  }
+  return { organizationId, role: payload.role, state: payload.state };
+}
+
+async function assertActiveOrganizationOwner(
+  token: string,
+  organizationId: number,
+  organizationLogin: string,
+): Promise<void> {
+  const membership = await getAuthenticatedOrganizationMembership(token, organizationLogin);
+  if (
+    membership.organizationId !== organizationId ||
+    membership.state !== "active" ||
+    membership.role !== "admin"
+  ) {
+    throw new GitHubInstallationAuthorityError(
+      "authority_denied",
+      "Only an active GitHub organization owner may bind this installation",
+    );
+  }
+}
+
 async function listUserAccessibleInstallations(
   token: string,
 ): Promise<GitHubAppInstallationSummary[]> {
@@ -544,8 +767,13 @@ function installationSummaryFromPayload(
     typeof payload.account === "object" && payload.account
       ? (payload.account as Record<string, unknown>)
       : {};
+  const accountId = asInt(account.id);
+  if (accountId === null) {
+    throw new GitHubAppApiError("GitHub returned an installation without an account id");
+  }
   return {
     installationId,
+    accountId,
     accountLogin: typeof account.login === "string" ? account.login : null,
     accountType: typeof account.type === "string" ? account.type : null,
     suspended: Boolean(payload.suspended_at),
@@ -555,7 +783,7 @@ function installationSummaryFromPayload(
 async function githubGet(
   path: string,
   token: string,
-  params: Record<string, string>,
+  params: Record<string, string> = {},
 ): Promise<any> {
   const url = new URL(`${githubApiBase}${path}`);
   for (const [key, value] of Object.entries(params)) {
@@ -563,7 +791,7 @@ async function githubGet(
   }
   const response = await fetch(url, { headers: githubHeaders(token) });
   if (!response.ok) {
-    throw new GitHubAppApiError(await githubErrorMessage(response));
+    throw new GitHubAppApiError(await githubErrorMessage(response), response.status);
   }
   return await response.json();
 }