@opengeni/github 0.3.22 → 0.4.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Settings } from '@opengeni/config';
-import { GitHubUserInstallationAccess, GitHubInstallationBindingProof, GitHubRepository } from '@opengeni/contracts';
+import { GitHubUserInstallationAccess, GitHubInstallationBindingProof, GitHubInstallationBindingCandidate, GitHubRepository } from '@opengeni/contracts';
 
 declare const stateMaxAgeSeconds: number;
 declare class GitHubAppConfigurationError extends Error {
@@ -79,6 +79,19 @@ declare function authorizeGitHubInstallationBinding(settings: Settings, input: {
     code: string;
     installationId: number;
 }): Promise<GitHubInstallationBindingProof>;
+/**
+ * Discover existing installations that the freshly authorized GitHub human
+ * can bind as an exact personal owner or active organization owner.
+ *
+ * `GET /user/installations` is discovery input only. Every candidate is
+ * cross-checked against the App's live installation inventory and an
+ * organization candidate requires a live `state=active, role=admin`
+ * membership proof. The later exact authorization still re-runs the complete
+ * proof immediately before the durable bind.
+ */
+declare function discoverGitHubInstallationBindingCandidates(settings: Settings, input: {
+    code: string;
+}): Promise<GitHubInstallationBindingCandidate[]>;
 declare function listGitHubAppRepositories(settings: Settings, input?: {
     installationIds?: number[];
 }): Promise<GitHubRepository[]>;
@@ -100,4 +113,4 @@ declare function githubAppBotIdentity(settings: Settings): {
 } | null;
 declare function normalizeGitHubAppPrivateKey(value: string): string;
 
-export { GitHubAppApiError, GitHubAppConfigurationError, type GitHubAppInstallationSummary, type GitHubAppInstallationToken, GitHubInstallationAuthorityError, type GitHubInstallationAuthorityFailure, type GitHubSignedStatePayload, authorizeGitHubAppUser, authorizeGitHubInstallationBinding, buildGitHubAppManifest, convertGitHubAppManifest, createGitHubAppInstallationToken, createGitHubAppInstallationTokenWithExpiry, createSignedState, envLinesFromGitHubManifestConversion, getGitHubAppInstallationSummary, githubAppBotIdentity, githubAppMissingSettings, githubOAuthAuthorizeUrl, listGitHubAppInstallationSummaries, listGitHubAppRepositories, normalizeGitHubAppPrivateKey, organizationAppManifestUrl, personalAppManifestUrl, readSignedState, stateMaxAgeSeconds, verifyGitHubInstallationAccessForUser, verifySignedState };
+export { GitHubAppApiError, GitHubAppConfigurationError, type GitHubAppInstallationSummary, type GitHubAppInstallationToken, GitHubInstallationAuthorityError, type GitHubInstallationAuthorityFailure, type GitHubSignedStatePayload, authorizeGitHubAppUser, authorizeGitHubInstallationBinding, buildGitHubAppManifest, convertGitHubAppManifest, createGitHubAppInstallationToken, createGitHubAppInstallationTokenWithExpiry, createSignedState, discoverGitHubInstallationBindingCandidates, envLinesFromGitHubManifestConversion, getGitHubAppInstallationSummary, githubAppBotIdentity, githubAppMissingSettings, githubOAuthAuthorizeUrl, listGitHubAppInstallationSummaries, listGitHubAppRepositories, normalizeGitHubAppPrivateKey, organizationAppManifestUrl, personalAppManifestUrl, readSignedState, stateMaxAgeSeconds, verifyGitHubInstallationAccessForUser, verifySignedState };

package/dist/index.js

@@ -57,7 +57,10 @@ function buildGitHubAppManifest(input) {
     redirect_url: `${base}/v1/github/app-manifest/callback`,
     callback_urls: [`${base}/v1/github/oauth/callback`],
     public: input.public,
-    request_oauth_on_install: true,
+    // A setup URL and OAuth-on-install are mutually exclusive in GitHub's App
+    // contract. OpenGeni needs the setup callback to receive the installation
+    // id, then starts its own exact user-authorization flow.
+    request_oauth_on_install: !input.setupUrl,
     default_permissions: permissions
   };
   if (input.setupUrl) {
@@ -256,6 +259,51 @@ async function authorizeGitHubInstallationBinding(settings, input) {
     repositories
   };
 }
+async function discoverGitHubInstallationBindingCandidates(settings, input) {
+  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);
+  const actor = await getAuthenticatedGitHubUser(userToken);
+  const visibleInstallations = await listUserAccessibleInstallations(userToken);
+  const jwt = await createGitHubAppJwt(settings);
+  const liveInstallations = new Map(
+    (await listInstallations(jwt)).map((payload) => {
+      const installation = installationSummaryFromPayload(payload);
+      return [installation.installationId, installation];
+    })
+  );
+  const candidates = [];
+  for (const visible of visibleInstallations) {
+    const installation = liveInstallations.get(visible.installationId);
+    if (!installation || installation.suspended || installation.accountId !== visible.accountId || installation.accountLogin !== visible.accountLogin || installation.accountType !== visible.accountType) {
+      continue;
+    }
+    if (installation.accountType === "User" && actor.id === installation.accountId) {
+      candidates.push({ installation, authorityKind: "personal_owner" });
+      continue;
+    }
+    if (installation.accountType !== "Organization" || !installation.accountLogin) {
+      continue;
+    }
+    try {
+      await assertActiveOrganizationOwner(
+        userToken,
+        installation.accountId,
+        installation.accountLogin
+      );
+      candidates.push({ installation, authorityKind: "organization_owner" });
+    } catch (error) {
+      if (error instanceof GitHubInstallationAuthorityError && error.reason === "authority_unavailable") {
+        continue;
+      }
+      if (error instanceof GitHubInstallationAuthorityError && error.reason === "authority_denied") {
+        continue;
+      }
+      throw error;
+    }
+  }
+  return candidates.sort(
+    (left, right) => (left.installation.accountLogin ?? "").localeCompare(right.installation.accountLogin ?? "")
+  );
+}
 async function listGitHubAppRepositories(settings, input = {}) {
   const missing = githubAppMissingSettings(settings);
   if (missing.length > 0) {
@@ -637,6 +685,7 @@ export {
   createGitHubAppInstallationToken,
   createGitHubAppInstallationTokenWithExpiry,
   createSignedState,
+  discoverGitHubInstallationBindingCandidates,
   envLinesFromGitHubManifestConversion,
   getGitHubAppInstallationSummary,
   githubAppBotIdentity,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type {\n  GitHubInstallationBindingProof,\n  GitHubRepository,\n  GitHubRepositoryPermissions,\n  GitHubUserInstallationAccess,\n  GitHubUserRepositoryAccess,\n} from \"@opengeni/contracts\";\nimport { createHmac, createPrivateKey, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { SignJWT, importPKCS8 } from \"jose\";\n\nconst githubApiBase = \"https://api.github.com\";\nconst githubApiVersion = \"2022-11-28\";\nconst githubTokenMintTimeoutMs = 60_000;\nexport const stateMaxAgeSeconds = 60 * 60;\nconst pkcs8PrivateKeyHeader = `-----BEGIN ${\"PRIVATE KEY\"}-----`;\nconst rsaPrivateKeyHeader = `-----BEGIN ${\"RSA PRIVATE KEY\"}-----`;\n\nexport class GitHubAppConfigurationError extends Error {\n  constructor(readonly missing: string[]) {\n    super(\"GitHub App is not configured\");\n  }\n}\n\nexport class GitHubAppApiError extends Error {\n  constructor(\n    message: string,\n    readonly status: number | null = null,\n  ) {\n    super(message);\n  }\n}\n\nexport type GitHubInstallationAuthorityFailure =\n  | \"authority_denied\"\n  | \"authority_unavailable\"\n  | \"installation_missing\"\n  | \"installation_suspended\"\n  | \"repository_access_empty\";\n\nexport class GitHubInstallationAuthorityError extends GitHubAppApiError {\n  constructor(\n    readonly reason: GitHubInstallationAuthorityFailure,\n    message: string,\n    status: number | null = null,\n  ) {\n    super(message, status);\n  }\n}\n\nexport type GitHubAppInstallationSummary = {\n  installationId: number;\n  accountId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubSignedStatePayload = {\n  nonce: string;\n  iat: number;\n  accountId?: string;\n  workspaceId?: string;\n  [key: string]: unknown;\n};\n\nexport function githubAppMissingSettings(settings: Settings): string[] {\n  const required: Record<string, string | undefined> = {\n    OPENGENI_GITHUB_APP_ID: settings.githubAppId,\n    OPENGENI_GITHUB_CLIENT_ID: settings.githubClientId,\n    OPENGENI_GITHUB_CLIENT_SECRET: settings.githubClientSecret,\n    OPENGENI_GITHUB_APP_SLUG: settings.githubAppSlug,\n    OPENGENI_GITHUB_APP_PRIVATE_KEY: settings.githubAppPrivateKey,\n  };\n  return Object.entries(required).flatMap(([name, value]) => (value && value.trim() ? [] : [name]));\n}\n\nexport function buildGitHubAppManifest(input: {\n  appName: string;\n  baseUrl: string;\n  public: boolean;\n  includeCiPermissions: boolean;\n  setupUrl?: string;\n}): Record<string, unknown> {\n  const base = input.baseUrl.replace(/\\/+$/, \"\");\n  const permissions: Record<string, string> = {\n    metadata: \"read\",\n    contents: \"write\",\n    pull_requests: \"write\",\n    // Required for the authenticated-user membership endpoint that proves an\n    // active organization owner. Existing installations must approve this\n    // permission before organization-owner self-service can succeed.\n    members: \"read\",\n  };\n  if (input.includeCiPermissions) {\n    permissions.actions = \"read\";\n    permissions.checks = \"read\";\n    permissions.statuses = \"write\";\n  }\n  const manifest: Record<string, unknown> = {\n    name: input.appName,\n    url: base,\n    redirect_url: `${base}/v1/github/app-manifest/callback`,\n    callback_urls: [`${base}/v1/github/oauth/callback`],\n    public: input.public,\n    request_oauth_on_install: true,\n    default_permissions: permissions,\n  };\n  if (input.setupUrl) {\n    manifest.setup_url = input.setupUrl;\n    manifest.setup_on_update = true;\n  }\n  return manifest;\n}\n\nexport function personalAppManifestUrl(state: string): string {\n  return `https://github.com/settings/apps/new?state=${state}`;\n}\n\nexport function organizationAppManifestUrl(organization: string, state: string): string {\n  return `https://github.com/organizations/${encodeURIComponent(organization)}/settings/apps/new?state=${state}`;\n}\n\nexport function githubOAuthAuthorizeUrl(input: {\n  clientId: string;\n  state: string;\n  redirectUri?: string;\n}): string {\n  const url = new URL(\"https://github.com/login/oauth/authorize\");\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"state\", input.state);\n  if (input.redirectUri) {\n    url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  }\n  return url.toString();\n}\n\nexport function createSignedState(\n  secret: string,\n  payloadOrNow: Record<string, unknown> | number = {},\n  nowArg = Math.floor(Date.now() / 1000),\n): string {\n  const payloadInput = typeof payloadOrNow === \"number\" ? {} : payloadOrNow;\n  const now = typeof payloadOrNow === \"number\" ? payloadOrNow : nowArg;\n  const payload = {\n    ...payloadInput,\n    nonce: randomBytes(16).toString(\"base64url\"),\n    iat: now,\n  };\n  const encoded = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  return `${encoded}.${signStatePayload(encoded, secret)}`;\n}\n\nexport function readSignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): GitHubSignedStatePayload | null {\n  const [encoded, signature] = state.split(\".\", 2);\n  if (!encoded || !signature) {\n    return null;\n  }\n  const expected = signStatePayload(encoded, secret);\n  if (!safeEqual(signature, expected)) {\n    return null;\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return null;\n  }\n  if (\n    !payload ||\n    typeof payload !== \"object\" ||\n    typeof (payload as { iat?: unknown }).iat !== \"number\" ||\n    typeof (payload as { nonce?: unknown }).nonce !== \"string\"\n  ) {\n    return null;\n  }\n  const age = now - (payload as { iat: number }).iat;\n  return age >= 0 && age <= stateMaxAgeSeconds ? (payload as GitHubSignedStatePayload) : null;\n}\n\nexport function verifySignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): boolean {\n  return readSignedState(state, secret, now) !== null;\n}\n\nexport function envLinesFromGitHubManifestConversion(payload: Record<string, unknown>): string[] {\n  const privateKey = String(payload.pem ?? \"\").replace(/\\n/g, \"\\\\n\");\n  return [\n    `OPENGENI_GITHUB_APP_ID=${payload.id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_ID=${payload.client_id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_SECRET=${payload.client_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_SLUG=${payload.slug ?? \"\"}`,\n    `OPENGENI_GITHUB_WEBHOOK_SECRET=${payload.webhook_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_PRIVATE_KEY=\"${privateKey}\"`,\n  ];\n}\n\nexport async function convertGitHubAppManifest(code: string): Promise<Record<string, unknown>> {\n  const response = await fetch(`${githubApiBase}/app-manifests/${code}/conversions`, {\n    method: \"POST\",\n    headers: githubHeaders(undefined),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || Array.isArray(payload)) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid manifest conversion payload\");\n  }\n  return payload as Record<string, unknown>;\n}\n\nexport async function listGitHubAppInstallationSummaries(\n  settings: Settings,\n): Promise<GitHubAppInstallationSummary[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  return installations.map(installationSummaryFromPayload);\n}\n\nexport async function getGitHubAppInstallationSummary(\n  settings: Settings,\n  installationId: number,\n): Promise<GitHubAppInstallationSummary | null> {\n  const installations = await listGitHubAppInstallationSummaries(settings);\n  return (\n    installations.find((installation) => installation.installationId === installationId) ?? null\n  );\n}\n\nexport async function verifyGitHubInstallationAccessForUser(\n  settings: Settings,\n  input: {\n    code: string;\n    installationId: number;\n  },\n): Promise<GitHubAppInstallationSummary> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  const installation = installations.find(\n    (candidate) => candidate.installationId === input.installationId,\n  );\n  if (!installation) {\n    throw new GitHubAppApiError(\"GitHub installation is not accessible to the installing user\");\n  }\n  return installation;\n}\n\n/**\n * Exchange a GitHub App user-authorization code and discover the installations\n * and repositories the user can explicitly access. This is compatibility\n * discovery metadata only: visibility and repository permission bits do not\n * prove that the human may install, configure, or bind the App installation.\n * No production binding path may treat this result as authority.\n */\nexport async function authorizeGitHubAppUser(\n  settings: Settings,\n  input: { code: string },\n): Promise<GitHubUserInstallationAccess[]> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  return await Promise.all(\n    installations.map(async (installation) => ({\n      ...installation,\n      repositories: installation.suspended\n        ? []\n        : await listUserInstallationRepositories(token, installation),\n    })),\n  );\n}\n\n/**\n * Prove current GitHub installation authority without treating repository\n * administration or installation visibility as delegation authority.\n *\n * GitHub exposes an exact personal-account owner through the authenticated\n * user's immutable id. For organizations, GitHub's authenticated membership\n * endpoint exposes active owners as role=admin. GitHub does not expose an\n * equivalent current-authority receipt for App Managers, so that case remains\n * unsupported and fails closed.\n */\nexport async function authorizeGitHubInstallationBinding(\n  settings: Settings,\n  input: { code: string; installationId: number },\n): Promise<GitHubInstallationBindingProof> {\n  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const actor = await getAuthenticatedGitHubUser(userToken);\n  const visibleInstallations = await listUserAccessibleInstallations(userToken);\n  const visible = visibleInstallations.find(\n    (installation) => installation.installationId === input.installationId,\n  );\n  if (!visible) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"GitHub did not associate this installation with the authorized user\",\n    );\n  }\n\n  const jwt = await createGitHubAppJwt(settings);\n  const livePayload = (await listInstallations(jwt)).find(\n    (installation) => asInt(installation.id) === input.installationId,\n  );\n  if (!livePayload) {\n    throw new GitHubInstallationAuthorityError(\n      \"installation_missing\",\n      \"GitHub App installation was deleted or is not owned by this App\",\n    );\n  }\n  const installation = installationSummaryFromPayload(livePayload);\n  if (\n    installation.accountId !== visible.accountId ||\n    installation.accountLogin !== visible.accountLogin ||\n    installation.accountType !== visible.accountType\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"GitHub installation identity changed during authorization\",\n    );\n  }\n  if (installation.suspended) {\n    throw new GitHubInstallationAuthorityError(\n      \"installation_suspended\",\n      \"GitHub App installation is suspended\",\n    );\n  }\n\n  let authorityKind: GitHubInstallationBindingProof[\"authorityKind\"];\n  if (installation.accountType === \"User\" && actor.id === installation.accountId) {\n    authorityKind = \"personal_owner\";\n  } else if (installation.accountType === \"Organization\" && installation.accountLogin) {\n    await assertActiveOrganizationOwner(\n      userToken,\n      installation.accountId,\n      installation.accountLogin,\n    );\n    authorityKind = \"organization_owner\";\n  } else {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"Only a GitHub personal-account owner or organization owner may bind an installation\",\n    );\n  }\n\n  const installationToken = await createInstallationToken(jwt, {\n    installationId: installation.installationId,\n  });\n  const repositories = await listInstallationRepositories(\n    installationToken.token,\n    installation.installationId,\n    { login: installation.accountLogin, type: installation.accountType },\n  );\n  if (repositories.length === 0) {\n    throw new GitHubInstallationAuthorityError(\n      \"repository_access_empty\",\n      \"GitHub App installation does not currently grant access to any repositories\",\n    );\n  }\n  if (authorityKind === \"organization_owner\") {\n    // Repository enumeration is an async provider boundary. Re-read the live\n    // owner tuple after it so a role revoked after the chooser proof cannot be\n    // durably bound with a later, misleading authority timestamp.\n    await assertActiveOrganizationOwner(\n      userToken,\n      installation.accountId,\n      installation.accountLogin!,\n    );\n  }\n  return {\n    actorId: actor.id,\n    actorLogin: actor.login,\n    authorityKind,\n    installation,\n    repositories,\n  };\n}\n\nexport async function listGitHubAppRepositories(\n  settings: Settings,\n  input: {\n    installationIds?: number[];\n  } = {},\n): Promise<GitHubRepository[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const allowedInstallations = input.installationIds ? new Set(input.installationIds) : null;\n  if (allowedInstallations && allowedInstallations.size === 0) {\n    return [];\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  const repositories: GitHubRepository[] = [];\n  for (const installation of installations) {\n    if (installation.suspended_at) {\n      continue;\n    }\n    const installationId = asInt(installation.id);\n    if (installationId === null) {\n      continue;\n    }\n    if (allowedInstallations && !allowedInstallations.has(installationId)) {\n      continue;\n    }\n    const account =\n      typeof installation.account === \"object\" && installation.account\n        ? (installation.account as Record<string, unknown>)\n        : {};\n    const token = await createInstallationToken(jwt, { installationId });\n    repositories.push(\n      ...(await listInstallationRepositories(token.token, installationId, account)),\n    );\n  }\n  repositories.sort((left, right) => left.fullName.localeCompare(right.fullName));\n  return repositories;\n}\n\nexport async function createGitHubAppInstallationToken(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds: number[];\n  },\n): Promise<string> {\n  return (await createGitHubAppInstallationTokenWithExpiry(settings, input)).token;\n}\n\nexport type GitHubAppInstallationToken = {\n  token: string;\n  expiresAt: string | null;\n};\n\nexport async function createGitHubAppInstallationTokenWithExpiry(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  if (!Array.isArray(input.repositoryIds)) {\n    throw new GitHubAppApiError(\n      \"GitHub installation token mint requires an explicit, unique repository allowlist\",\n    );\n  }\n  const repositoryIds = [...new Set(input.repositoryIds)];\n  if (\n    !Number.isSafeInteger(input.installationId) ||\n    input.installationId <= 0 ||\n    repositoryIds.length === 0 ||\n    repositoryIds.length !== input.repositoryIds.length ||\n    repositoryIds.some((id) => !Number.isSafeInteger(id) || id <= 0)\n  ) {\n    throw new GitHubAppApiError(\n      \"GitHub installation token mint requires an explicit, unique repository allowlist\",\n    );\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  return await createInstallationToken(jwt, {\n    installationId: input.installationId,\n    repositoryIds,\n  });\n}\n\nexport function githubAppBotIdentity(settings: Settings): { name: string; email: string } | null {\n  const appId = settings.githubAppId?.trim();\n  const slug = settings.githubAppSlug?.trim();\n  if (!appId || !slug) {\n    return null;\n  }\n  const login = `${slug}[bot]`;\n  return {\n    name: login,\n    email: `${appId}+${login}@users.noreply.github.com`,\n  };\n}\n\nasync function createGitHubAppJwt(settings: Settings): Promise<string> {\n  const privateKey = normalizeGitHubAppPrivateKey(settings.githubAppPrivateKey ?? \"\");\n  const appId = settings.githubAppId?.trim();\n  if (!appId || !privateKey) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const key = await importPKCS8(privateKey, \"RS256\");\n  const now = Math.floor(Date.now() / 1000);\n  return await new SignJWT({})\n    .setProtectedHeader({ alg: \"RS256\" })\n    .setIssuedAt(now - 60)\n    .setExpirationTime(now + 9 * 60)\n    .setIssuer(appId)\n    .sign(key);\n}\n\nasync function listInstallations(token: string): Promise<Array<Record<string, unknown>>> {\n  const out: Array<Record<string, unknown>> = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/app/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (!Array.isArray(payload)) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid installations payload\");\n    }\n    out.push(\n      ...payload.filter((item): item is Record<string, unknown> =>\n        Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n      ),\n    );\n    if (payload.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function exchangeGitHubOAuthCodeForUserToken(\n  settings: Settings,\n  code: string,\n): Promise<string> {\n  if (!settings.githubClientId || !settings.githubClientSecret) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const response = await fetch(\"https://github.com/login/oauth/access_token\", {\n    method: \"POST\",\n    headers: {\n      Accept: \"application/json\",\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      client_id: settings.githubClientId,\n      client_secret: settings.githubClientSecret,\n      code,\n    }),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.access_token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid OAuth token payload\");\n  }\n  return payload.access_token;\n}\n\nasync function getAuthenticatedGitHubUser(token: string): Promise<{ id: number; login: string }> {\n  const payload = await githubGet(\"/user\", token);\n  const id = payload && typeof payload === \"object\" ? asInt(payload.id) : null;\n  const login =\n    payload && typeof payload === \"object\" && typeof payload.login === \"string\"\n      ? payload.login\n      : null;\n  if (id === null || !login) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid authenticated user payload\");\n  }\n  return { id, login };\n}\n\nasync function getAuthenticatedOrganizationMembership(\n  token: string,\n  organizationLogin: string,\n): Promise<{ organizationId: number; role: string; state: string }> {\n  let payload: any;\n  try {\n    payload = await githubGet(\n      `/user/memberships/orgs/${encodeURIComponent(organizationLogin)}`,\n      token,\n    );\n  } catch (error) {\n    if (error instanceof GitHubAppApiError) {\n      throw new GitHubInstallationAuthorityError(\n        \"authority_unavailable\",\n        \"GitHub could not prove current organization-owner membership\",\n        error.status,\n      );\n    }\n    throw error;\n  }\n  const organization =\n    payload && typeof payload === \"object\" && payload.organization ? payload.organization : null;\n  const organizationId =\n    organization && typeof organization === \"object\" ? asInt(organization.id) : null;\n  if (\n    organizationId === null ||\n    typeof payload?.role !== \"string\" ||\n    typeof payload?.state !== \"string\"\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_unavailable\",\n      \"GitHub returned an invalid organization membership proof\",\n    );\n  }\n  return { organizationId, role: payload.role, state: payload.state };\n}\n\nasync function assertActiveOrganizationOwner(\n  token: string,\n  organizationId: number,\n  organizationLogin: string,\n): Promise<void> {\n  const membership = await getAuthenticatedOrganizationMembership(token, organizationLogin);\n  if (\n    membership.organizationId !== organizationId ||\n    membership.state !== \"active\" ||\n    membership.role !== \"admin\"\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"Only an active GitHub organization owner may bind this installation\",\n    );\n  }\n}\n\nasync function listUserAccessibleInstallations(\n  token: string,\n): Promise<GitHubAppInstallationSummary[]> {\n  const out: GitHubAppInstallationSummary[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/user/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    const installations: unknown[] | null =\n      payload && typeof payload === \"object\" && Array.isArray(payload.installations)\n        ? (payload.installations as unknown[])\n        : null;\n    if (!installations) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid user installations payload\");\n    }\n    out.push(\n      ...installations\n        .filter((item): item is Record<string, unknown> =>\n          Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n        )\n        .map(installationSummaryFromPayload),\n    );\n    if (installations.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function listUserInstallationRepositories(\n  token: string,\n  installation: GitHubAppInstallationSummary,\n): Promise<GitHubUserRepositoryAccess[]> {\n  const out: GitHubUserRepositoryAccess[] = [];\n  const account = {\n    ...(installation.accountLogin ? { login: installation.accountLogin } : {}),\n    ...(installation.accountType ? { type: installation.accountType } : {}),\n  };\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\n      `/user/installations/${installation.installationId}/repositories`,\n      token,\n      { per_page: \"100\", page: String(page) },\n    );\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\n        \"GitHub returned an invalid user installation repositories payload\",\n      );\n    }\n    for (const repository of payload.repositories) {\n      if (!repository || typeof repository !== \"object\" || Array.isArray(repository)) {\n        continue;\n      }\n      const record = repository as Record<string, unknown>;\n      out.push({\n        ...repositoryFromPayload(record, installation.installationId, account),\n        permissions: repositoryPermissionsFromPayload(record.permissions),\n      });\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function createInstallationToken(\n  appJwt: string,\n  input: {\n    installationId: number;\n    repositoryIds?: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const scoped = input.repositoryIds && input.repositoryIds.length > 0;\n  const response = await fetch(\n    `${githubApiBase}/app/installations/${input.installationId}/access_tokens`,\n    {\n      method: \"POST\",\n      headers: {\n        ...githubHeaders(appJwt),\n        ...(scoped ? { \"Content-Type\": \"application/json\" } : {}),\n      },\n      signal: AbortSignal.timeout(githubTokenMintTimeoutMs),\n      ...(scoped ? { body: JSON.stringify({ repository_ids: input.repositoryIds }) } : {}),\n    },\n  );\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid installation token payload\");\n  }\n  return {\n    token: payload.token,\n    expiresAt: typeof payload.expires_at === \"string\" ? payload.expires_at : null,\n  };\n}\n\nasync function listInstallationRepositories(\n  token: string,\n  installationId: number,\n  account: Record<string, unknown>,\n): Promise<GitHubRepository[]> {\n  const out: GitHubRepository[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/installation/repositories\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid repositories payload\");\n    }\n    for (const repo of payload.repositories) {\n      if (repo && typeof repo === \"object\" && !Array.isArray(repo)) {\n        out.push(repositoryFromPayload(repo as Record<string, unknown>, installationId, account));\n      }\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nfunction installationSummaryFromPayload(\n  payload: Record<string, unknown>,\n): GitHubAppInstallationSummary {\n  const installationId = asInt(payload.id);\n  if (installationId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without id\");\n  }\n  const account =\n    typeof payload.account === \"object\" && payload.account\n      ? (payload.account as Record<string, unknown>)\n      : {};\n  const accountId = asInt(account.id);\n  if (accountId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without an account id\");\n  }\n  return {\n    installationId,\n    accountId,\n    accountLogin: typeof account.login === \"string\" ? account.login : null,\n    accountType: typeof account.type === \"string\" ? account.type : null,\n    suspended: Boolean(payload.suspended_at),\n  };\n}\n\nasync function githubGet(\n  path: string,\n  token: string,\n  params: Record<string, string> = {},\n): Promise<any> {\n  const url = new URL(`${githubApiBase}${path}`);\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, value);\n  }\n  const response = await fetch(url, { headers: githubHeaders(token) });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response), response.status);\n  }\n  return await response.json();\n}\n\nfunction repositoryFromPayload(\n  payload: Record<string, unknown>,\n  installationId: number,\n  account: Record<string, unknown>,\n): GitHubRepository {\n  const id = asInt(payload.id);\n  const fullName = String(payload.full_name ?? \"\");\n  if (id === null || !fullName) {\n    throw new GitHubAppApiError(\"GitHub returned a repository without id/full_name\");\n  }\n  return {\n    id,\n    installationId,\n    fullName,\n    name: String(payload.name ?? fullName.split(\"/\").at(-1) ?? fullName),\n    private: Boolean(payload.private),\n    htmlUrl: String(payload.html_url ?? `https://github.com/${fullName}`),\n    cloneUrl: String(payload.clone_url ?? `https://github.com/${fullName}.git`),\n    defaultBranch: String(payload.default_branch ?? \"main\"),\n    accountLogin: String(account.login ?? fullName.split(\"/\", 1)[0]),\n    accountType: typeof account.type === \"string\" ? account.type : null,\n  };\n}\n\nfunction repositoryPermissionsFromPayload(payload: unknown): GitHubRepositoryPermissions {\n  const permissions =\n    payload && typeof payload === \"object\" && !Array.isArray(payload)\n      ? (payload as Record<string, unknown>)\n      : {};\n  return {\n    admin: permissions.admin === true,\n    maintain: permissions.maintain === true,\n    push: permissions.push === true,\n    triage: permissions.triage === true,\n    pull: permissions.pull === true,\n  };\n}\n\nfunction githubHeaders(token?: string): HeadersInit {\n  return {\n    Accept: \"application/vnd.github+json\",\n    ...(token ? { Authorization: `Bearer ${token}` } : {}),\n    \"X-GitHub-Api-Version\": githubApiVersion,\n  };\n}\n\nasync function githubErrorMessage(response: Response): Promise<string> {\n  try {\n    const payload = await response.json();\n    if (payload && typeof payload === \"object\" && \"message\" in payload) {\n      return `GitHub API ${response.status}: ${String(payload.message)}`;\n    }\n  } catch {\n    // fall through\n  }\n  return `GitHub API ${response.status}: ${await response.text()}`;\n}\n\nexport function normalizeGitHubAppPrivateKey(value: string): string {\n  const privateKey = value.trim().replace(/\\\\n/g, \"\\n\");\n  if (!privateKey || privateKey.startsWith(pkcs8PrivateKeyHeader)) {\n    return privateKey;\n  }\n  if (privateKey.startsWith(rsaPrivateKeyHeader)) {\n    return createPrivateKey(privateKey).export({ type: \"pkcs8\", format: \"pem\" }).toString();\n  }\n  return privateKey;\n}\n\nfunction signStatePayload(encoded: string, secret: string): string {\n  return createHmac(\"sha256\", secret).update(encoded).digest(\"base64url\");\n}\n\nfunction safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction asInt(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value)) {\n    return value;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) {\n    return Number(value);\n  }\n  return null;\n}\n"],"mappings":";AAQA,SAAS,YAAY,kBAAkB,aAAa,uBAAuB;AAC3E,SAAS,SAAS,mBAAmB;AAErC,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,2BAA2B;AAC1B,IAAM,qBAAqB,KAAK;AACvC,IAAM,wBAAwB,cAAc,aAAa;AACzD,IAAM,sBAAsB,cAAc,iBAAiB;AAEpD,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAqB,SAAmB;AACtC,UAAM,8BAA8B;AADjB;AAAA,EAErB;AACF;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YACE,SACS,SAAwB,MACjC;AACA,UAAM,OAAO;AAFJ;AAAA,EAGX;AACF;AASO,IAAM,mCAAN,cAA+C,kBAAkB;AAAA,EACtE,YACW,QACT,SACA,SAAwB,MACxB;AACA,UAAM,SAAS,MAAM;AAJZ;AAAA,EAKX;AACF;AAkBO,SAAS,yBAAyB,UAA8B;AACrE,QAAM,WAA+C;AAAA,IACnD,wBAAwB,SAAS;AAAA,IACjC,2BAA2B,SAAS;AAAA,IACpC,+BAA+B,SAAS;AAAA,IACxC,0BAA0B,SAAS;AAAA,IACnC,iCAAiC,SAAS;AAAA,EAC5C;AACA,SAAO,OAAO,QAAQ,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAO,SAAS,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE;AAClG;AAEO,SAAS,uBAAuB,OAMX;AAC1B,QAAM,OAAO,MAAM,QAAQ,QAAQ,QAAQ,EAAE;AAC7C,QAAM,cAAsC;AAAA,IAC1C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,eAAe;AAAA;AAAA;AAAA;AAAA,IAIf,SAAS;AAAA,EACX;AACA,MAAI,MAAM,sBAAsB;AAC9B,gBAAY,UAAU;AACtB,gBAAY,SAAS;AACrB,gBAAY,WAAW;AAAA,EACzB;AACA,QAAM,WAAoC;AAAA,IACxC,MAAM,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,cAAc,GAAG,IAAI;AAAA,IACrB,eAAe,CAAC,GAAG,IAAI,2BAA2B;AAAA,IAClD,QAAQ,MAAM;AAAA,IACd,0BAA0B;AAAA,IAC1B,qBAAqB;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,aAAS,YAAY,MAAM;AAC3B,aAAS,kBAAkB;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAuB;AAC5D,SAAO,8CAA8C,KAAK;AAC5D;AAEO,SAAS,2BAA2B,cAAsB,OAAuB;AACtF,SAAO,oCAAoC,mBAAmB,YAAY,CAAC,4BAA4B,KAAK;AAC9G;AAEO,SAAS,wBAAwB,OAI7B;AACT,QAAM,MAAM,IAAI,IAAI,0CAA0C;AAC9D,MAAI,aAAa,IAAI,aAAa,MAAM,QAAQ;AAChD,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,MAAI,MAAM,aAAa;AACrB,QAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;AAAA,EACxD;AACA,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,kBACd,QACA,eAAiD,CAAC,GAClD,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC7B;AACR,QAAM,eAAe,OAAO,iBAAiB,WAAW,CAAC,IAAI;AAC7D,QAAM,MAAM,OAAO,iBAAiB,WAAW,eAAe;AAC9D,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,IAC3C,KAAK;AAAA,EACP;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AACzE,SAAO,GAAG,OAAO,IAAI,iBAAiB,SAAS,MAAM,CAAC;AACxD;AAEO,SAAS,gBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACD;AACjC,QAAM,CAAC,SAAS,SAAS,IAAI,MAAM,MAAM,KAAK,CAAC;AAC/C,MAAI,CAAC,WAAW,CAAC,WAAW;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,iBAAiB,SAAS,MAAM;AACjD,MAAI,CAAC,UAAU,WAAW,QAAQ,GAAG;AACnC,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,CAAC,WACD,OAAO,YAAY,YACnB,OAAQ,QAA8B,QAAQ,YAC9C,OAAQ,QAAgC,UAAU,UAClD;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAO,QAA4B;AAC/C,SAAO,OAAO,KAAK,OAAO,qBAAsB,UAAuC;AACzF;AAEO,SAAS,kBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACzB;AACT,SAAO,gBAAgB,OAAO,QAAQ,GAAG,MAAM;AACjD;AAEO,SAAS,qCAAqC,SAA4C;AAC/F,QAAM,aAAa,OAAO,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,KAAK;AACjE,SAAO;AAAA,IACL,0BAA0B,QAAQ,MAAM,EAAE;AAAA,IAC1C,6BAA6B,QAAQ,aAAa,EAAE;AAAA,IACpD,iCAAiC,QAAQ,iBAAiB,EAAE;AAAA,IAC5D,4BAA4B,QAAQ,QAAQ,EAAE;AAAA,IAC9C,kCAAkC,QAAQ,kBAAkB,EAAE;AAAA,IAC9D,oCAAoC,UAAU;AAAA,EAChD;AACF;AAEA,eAAsB,yBAAyB,MAAgD;AAC7F,QAAM,WAAW,MAAM,MAAM,GAAG,aAAa,kBAAkB,IAAI,gBAAgB;AAAA,IACjF,QAAQ;AAAA,IACR,SAAS,cAAc,MAAS;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,UAAM,IAAI,kBAAkB,wDAAwD;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,mCACpB,UACyC;AACzC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,SAAO,cAAc,IAAI,8BAA8B;AACzD;AAEA,eAAsB,gCACpB,UACA,gBAC8C;AAC9C,QAAM,gBAAgB,MAAM,mCAAmC,QAAQ;AACvE,SACE,cAAc,KAAK,CAAC,iBAAiB,aAAa,mBAAmB,cAAc,KAAK;AAE5F;AAEA,eAAsB,sCACpB,UACA,OAIuC;AACvC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,QAAM,eAAe,cAAc;AAAA,IACjC,CAAC,cAAc,UAAU,mBAAmB,MAAM;AAAA,EACpD;AACA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,kBAAkB,8DAA8D;AAAA,EAC5F;AACA,SAAO;AACT;AASA,eAAsB,uBACpB,UACA,OACyC;AACzC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,SAAO,MAAM,QAAQ;AAAA,IACnB,cAAc,IAAI,OAAO,kBAAkB;AAAA,MACzC,GAAG;AAAA,MACH,cAAc,aAAa,YACvB,CAAC,IACD,MAAM,iCAAiC,OAAO,YAAY;AAAA,IAChE,EAAE;AAAA,EACJ;AACF;AAYA,eAAsB,mCACpB,UACA,OACyC;AACzC,QAAM,YAAY,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAChF,QAAM,QAAQ,MAAM,2BAA2B,SAAS;AACxD,QAAM,uBAAuB,MAAM,gCAAgC,SAAS;AAC5E,QAAM,UAAU,qBAAqB;AAAA,IACnC,CAACA,kBAAiBA,cAAa,mBAAmB,MAAM;AAAA,EAC1D;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,eAAe,MAAM,kBAAkB,GAAG,GAAG;AAAA,IACjD,CAACA,kBAAiB,MAAMA,cAAa,EAAE,MAAM,MAAM;AAAA,EACrD;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,+BAA+B,WAAW;AAC/D,MACE,aAAa,cAAc,QAAQ,aACnC,aAAa,iBAAiB,QAAQ,gBACtC,aAAa,gBAAgB,QAAQ,aACrC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,aAAa,WAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,aAAa,gBAAgB,UAAU,MAAM,OAAO,aAAa,WAAW;AAC9E,oBAAgB;AAAA,EAClB,WAAW,aAAa,gBAAgB,kBAAkB,aAAa,cAAc;AACnF,UAAM;AAAA,MACJ;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AACA,oBAAgB;AAAA,EAClB,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,MAAM,wBAAwB,KAAK;AAAA,IAC3D,gBAAgB,aAAa;AAAA,EAC/B,CAAC;AACD,QAAM,eAAe,MAAM;AAAA,IACzB,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,EAAE,OAAO,aAAa,cAAc,MAAM,aAAa,YAAY;AAAA,EACrE;AACA,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,sBAAsB;AAI1C,UAAM;AAAA,MACJ;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,UACA,QAEI,CAAC,GACwB;AAC7B,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,uBAAuB,MAAM,kBAAkB,IAAI,IAAI,MAAM,eAAe,IAAI;AACtF,MAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC3D,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,QAAM,eAAmC,CAAC;AAC1C,aAAW,gBAAgB,eAAe;AACxC,QAAI,aAAa,cAAc;AAC7B;AAAA,IACF;AACA,UAAM,iBAAiB,MAAM,aAAa,EAAE;AAC5C,QAAI,mBAAmB,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,wBAAwB,CAAC,qBAAqB,IAAI,cAAc,GAAG;AACrE;AAAA,IACF;AACA,UAAM,UACJ,OAAO,aAAa,YAAY,YAAY,aAAa,UACpD,aAAa,UACd,CAAC;AACP,UAAM,QAAQ,MAAM,wBAAwB,KAAK,EAAE,eAAe,CAAC;AACnE,iBAAa;AAAA,MACX,GAAI,MAAM,6BAA6B,MAAM,OAAO,gBAAgB,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,eAAa,KAAK,CAAC,MAAM,UAAU,KAAK,SAAS,cAAc,MAAM,QAAQ,CAAC;AAC9E,SAAO;AACT;AAEA,eAAsB,iCACpB,UACA,OAIiB;AACjB,UAAQ,MAAM,2CAA2C,UAAU,KAAK,GAAG;AAC7E;AAOA,eAAsB,2CACpB,UACA,OAIqC;AACrC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,aAAa,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,MAAM,aAAa,CAAC;AACtD,MACE,CAAC,OAAO,cAAc,MAAM,cAAc,KAC1C,MAAM,kBAAkB,KACxB,cAAc,WAAW,KACzB,cAAc,WAAW,MAAM,cAAc,UAC7C,cAAc,KAAK,CAAC,OAAO,CAAC,OAAO,cAAc,EAAE,KAAK,MAAM,CAAC,GAC/D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,SAAO,MAAM,wBAAwB,KAAK;AAAA,IACxC,gBAAgB,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qBAAqB,UAA4D;AAC/F,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,QAAM,OAAO,SAAS,eAAe,KAAK;AAC1C,MAAI,CAAC,SAAS,CAAC,MAAM;AACnB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,GAAG,IAAI;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,GAAG,KAAK,IAAI,KAAK;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,QAAM,aAAa,6BAA6B,SAAS,uBAAuB,EAAE;AAClF,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,MAAI,CAAC,SAAS,CAAC,YAAY;AACzB,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,MAAM,MAAM,YAAY,YAAY,OAAO;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,EACxB,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,MAAM,EAAE,EACpB,kBAAkB,MAAM,IAAI,EAAE,EAC9B,UAAU,KAAK,EACf,KAAK,GAAG;AACb;AAEA,eAAe,kBAAkB,OAAwD;AACvF,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,sBAAsB,OAAO;AAAA,MAC3D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,YAAM,IAAI,kBAAkB,kDAAkD;AAAA,IAChF;AACA,QAAI;AAAA,MACF,GAAG,QAAQ;AAAA,QAAO,CAAC,SACjB,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,oCACb,UACA,MACiB;AACjB,MAAI,CAAC,SAAS,kBAAkB,CAAC,SAAS,oBAAoB;AAC5D,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,WAAW,MAAM,MAAM,+CAA+C;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,eAAe,SAAS;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,iBAAiB,UAAU;AACvF,UAAM,IAAI,kBAAkB,gDAAgD;AAAA,EAC9E;AACA,SAAO,QAAQ;AACjB;AAEA,eAAe,2BAA2B,OAAuD;AAC/F,QAAM,UAAU,MAAM,UAAU,SAAS,KAAK;AAC9C,QAAM,KAAK,WAAW,OAAO,YAAY,WAAW,MAAM,QAAQ,EAAE,IAAI;AACxE,QAAM,QACJ,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,WAC/D,QAAQ,QACR;AACN,MAAI,OAAO,QAAQ,CAAC,OAAO;AACzB,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO,EAAE,IAAI,MAAM;AACrB;AAEA,eAAe,uCACb,OACA,mBACkE;AAClE,MAAI;AACJ,MAAI;AACF,cAAU,MAAM;AAAA,MACd,0BAA0B,mBAAmB,iBAAiB,CAAC;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAmB;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,eACJ,WAAW,OAAO,YAAY,YAAY,QAAQ,eAAe,QAAQ,eAAe;AAC1F,QAAM,iBACJ,gBAAgB,OAAO,iBAAiB,WAAW,MAAM,aAAa,EAAE,IAAI;AAC9E,MACE,mBAAmB,QACnB,OAAO,SAAS,SAAS,YACzB,OAAO,SAAS,UAAU,UAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,gBAAgB,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM;AACpE;AAEA,eAAe,8BACb,OACA,gBACA,mBACe;AACf,QAAM,aAAa,MAAM,uCAAuC,OAAO,iBAAiB;AACxF,MACE,WAAW,mBAAmB,kBAC9B,WAAW,UAAU,YACrB,WAAW,SAAS,SACpB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gCACb,OACyC;AACzC,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,uBAAuB,OAAO;AAAA,MAC5D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,UAAM,gBACJ,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,QAAQ,aAAa,IACxE,QAAQ,gBACT;AACN,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,kBAAkB,uDAAuD;AAAA,IACrF;AACA,QAAI;AAAA,MACF,GAAG,cACA;AAAA,QAAO,CAAC,SACP,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE,EACC,IAAI,8BAA8B;AAAA,IACvC;AACA,QAAI,cAAc,SAAS,KAAK;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,iCACb,OACA,cACuC;AACvC,QAAM,MAAoC,CAAC;AAC3C,QAAM,UAAU;AAAA,IACd,GAAI,aAAa,eAAe,EAAE,OAAO,aAAa,aAAa,IAAI,CAAC;AAAA,IACxE,GAAI,aAAa,cAAc,EAAE,MAAM,aAAa,YAAY,IAAI,CAAC;AAAA,EACvE;AACA,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM;AAAA,MACpB,uBAAuB,aAAa,cAAc;AAAA,MAClD;AAAA,MACA,EAAE,UAAU,OAAO,MAAM,OAAO,IAAI,EAAE;AAAA,IACxC;AACA,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,eAAW,cAAc,QAAQ,cAAc;AAC7C,UAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AAC9E;AAAA,MACF;AACA,YAAM,SAAS;AACf,UAAI,KAAK;AAAA,QACP,GAAG,sBAAsB,QAAQ,aAAa,gBAAgB,OAAO;AAAA,QACrE,aAAa,iCAAiC,OAAO,WAAW;AAAA,MAClE,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,wBACb,QACA,OAIqC;AACrC,QAAM,SAAS,MAAM,iBAAiB,MAAM,cAAc,SAAS;AACnE,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,aAAa,sBAAsB,MAAM,cAAc;AAAA,IAC1D;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,GAAG,cAAc,MAAM;AAAA,QACvB,GAAI,SAAS,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,MACzD;AAAA,MACA,QAAQ,YAAY,QAAQ,wBAAwB;AAAA,MACpD,GAAI,SAAS,EAAE,MAAM,KAAK,UAAU,EAAE,gBAAgB,MAAM,cAAc,CAAC,EAAE,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,UAAU;AAChF,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,WAAW,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,EAC3E;AACF;AAEA,eAAe,6BACb,OACA,gBACA,SAC6B;AAC7B,QAAM,MAA0B,CAAC;AACjC,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,8BAA8B,OAAO;AAAA,MACnE,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI,kBAAkB,iDAAiD;AAAA,IAC/E;AACA,eAAW,QAAQ,QAAQ,cAAc;AACvC,UAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AAC5D,YAAI,KAAK,sBAAsB,MAAiC,gBAAgB,OAAO,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,+BACP,SAC8B;AAC9B,QAAM,iBAAiB,MAAM,QAAQ,EAAE;AACvC,MAAI,mBAAmB,MAAM;AAC3B,UAAM,IAAI,kBAAkB,4CAA4C;AAAA,EAC1E;AACA,QAAM,UACJ,OAAO,QAAQ,YAAY,YAAY,QAAQ,UAC1C,QAAQ,UACT,CAAC;AACP,QAAM,YAAY,MAAM,QAAQ,EAAE;AAClC,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAClE,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IAC/D,WAAW,QAAQ,QAAQ,YAAY;AAAA,EACzC;AACF;AAEA,eAAe,UACb,MACA,OACA,SAAiC,CAAC,GACpB;AACd,QAAM,MAAM,IAAI,IAAI,GAAG,aAAa,GAAG,IAAI,EAAE;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AACnE,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,GAAG,SAAS,MAAM;AAAA,EACjF;AACA,SAAO,MAAM,SAAS,KAAK;AAC7B;AAEA,SAAS,sBACP,SACA,gBACA,SACkB;AAClB,QAAM,KAAK,MAAM,QAAQ,EAAE;AAC3B,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAC/C,MAAI,OAAO,QAAQ,CAAC,UAAU;AAC5B,UAAM,IAAI,kBAAkB,mDAAmD;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,QAAQ,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,QAAQ;AAAA,IACnE,SAAS,QAAQ,QAAQ,OAAO;AAAA,IAChC,SAAS,OAAO,QAAQ,YAAY,sBAAsB,QAAQ,EAAE;AAAA,IACpE,UAAU,OAAO,QAAQ,aAAa,sBAAsB,QAAQ,MAAM;AAAA,IAC1E,eAAe,OAAO,QAAQ,kBAAkB,MAAM;AAAA,IACtD,cAAc,OAAO,QAAQ,SAAS,SAAS,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,IAC/D,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,EACjE;AACF;AAEA,SAAS,iCAAiC,SAA+C;AACvF,QAAM,cACJ,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3D,UACD,CAAC;AACP,SAAO;AAAA,IACL,OAAO,YAAY,UAAU;AAAA,IAC7B,UAAU,YAAY,aAAa;AAAA,IACnC,MAAM,YAAY,SAAS;AAAA,IAC3B,QAAQ,YAAY,WAAW;AAAA,IAC/B,MAAM,YAAY,SAAS;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,OAA6B;AAClD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,GAAI,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AAAA,IACpD,wBAAwB;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,MAAI;AACF,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,QAAI,WAAW,OAAO,YAAY,YAAY,aAAa,SAAS;AAClE,aAAO,cAAc,SAAS,MAAM,KAAK,OAAO,QAAQ,OAAO,CAAC;AAAA,IAClE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,cAAc,SAAS,MAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAChE;AAEO,SAAS,6BAA6B,OAAuB;AAClE,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,QAAQ,IAAI;AACpD,MAAI,CAAC,cAAc,WAAW,WAAW,qBAAqB,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,MAAI,WAAW,WAAW,mBAAmB,GAAG;AAC9C,WAAO,iBAAiB,UAAU,EAAE,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,QAAwB;AACjE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW;AACxE;AAEA,SAAS,UAAU,MAAc,OAAwB;AACvD,QAAM,IAAI,OAAO,KAAK,IAAI;AAC1B,QAAM,IAAI,OAAO,KAAK,KAAK;AAC3B,SAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAEA,SAAS,MAAM,OAA+B;AAC5C,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,GAAG;AACpD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;","names":["installation"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport type {\n  GitHubInstallationBindingCandidate,\n  GitHubInstallationBindingProof,\n  GitHubRepository,\n  GitHubRepositoryPermissions,\n  GitHubUserInstallationAccess,\n  GitHubUserRepositoryAccess,\n} from \"@opengeni/contracts\";\nimport { createHmac, createPrivateKey, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { SignJWT, importPKCS8 } from \"jose\";\n\nconst githubApiBase = \"https://api.github.com\";\nconst githubApiVersion = \"2022-11-28\";\nconst githubTokenMintTimeoutMs = 60_000;\nexport const stateMaxAgeSeconds = 60 * 60;\nconst pkcs8PrivateKeyHeader = `-----BEGIN ${\"PRIVATE KEY\"}-----`;\nconst rsaPrivateKeyHeader = `-----BEGIN ${\"RSA PRIVATE KEY\"}-----`;\n\nexport class GitHubAppConfigurationError extends Error {\n  constructor(readonly missing: string[]) {\n    super(\"GitHub App is not configured\");\n  }\n}\n\nexport class GitHubAppApiError extends Error {\n  constructor(\n    message: string,\n    readonly status: number | null = null,\n  ) {\n    super(message);\n  }\n}\n\nexport type GitHubInstallationAuthorityFailure =\n  | \"authority_denied\"\n  | \"authority_unavailable\"\n  | \"installation_missing\"\n  | \"installation_suspended\"\n  | \"repository_access_empty\";\n\nexport class GitHubInstallationAuthorityError extends GitHubAppApiError {\n  constructor(\n    readonly reason: GitHubInstallationAuthorityFailure,\n    message: string,\n    status: number | null = null,\n  ) {\n    super(message, status);\n  }\n}\n\nexport type GitHubAppInstallationSummary = {\n  installationId: number;\n  accountId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubSignedStatePayload = {\n  nonce: string;\n  iat: number;\n  accountId?: string;\n  workspaceId?: string;\n  [key: string]: unknown;\n};\n\nexport function githubAppMissingSettings(settings: Settings): string[] {\n  const required: Record<string, string | undefined> = {\n    OPENGENI_GITHUB_APP_ID: settings.githubAppId,\n    OPENGENI_GITHUB_CLIENT_ID: settings.githubClientId,\n    OPENGENI_GITHUB_CLIENT_SECRET: settings.githubClientSecret,\n    OPENGENI_GITHUB_APP_SLUG: settings.githubAppSlug,\n    OPENGENI_GITHUB_APP_PRIVATE_KEY: settings.githubAppPrivateKey,\n  };\n  return Object.entries(required).flatMap(([name, value]) => (value && value.trim() ? [] : [name]));\n}\n\nexport function buildGitHubAppManifest(input: {\n  appName: string;\n  baseUrl: string;\n  public: boolean;\n  includeCiPermissions: boolean;\n  setupUrl?: string;\n}): Record<string, unknown> {\n  const base = input.baseUrl.replace(/\\/+$/, \"\");\n  const permissions: Record<string, string> = {\n    metadata: \"read\",\n    contents: \"write\",\n    pull_requests: \"write\",\n    // Required for the authenticated-user membership endpoint that proves an\n    // active organization owner. Existing installations must approve this\n    // permission before organization-owner self-service can succeed.\n    members: \"read\",\n  };\n  if (input.includeCiPermissions) {\n    permissions.actions = \"read\";\n    permissions.checks = \"read\";\n    permissions.statuses = \"write\";\n  }\n  const manifest: Record<string, unknown> = {\n    name: input.appName,\n    url: base,\n    redirect_url: `${base}/v1/github/app-manifest/callback`,\n    callback_urls: [`${base}/v1/github/oauth/callback`],\n    public: input.public,\n    // A setup URL and OAuth-on-install are mutually exclusive in GitHub's App\n    // contract. OpenGeni needs the setup callback to receive the installation\n    // id, then starts its own exact user-authorization flow.\n    request_oauth_on_install: !input.setupUrl,\n    default_permissions: permissions,\n  };\n  if (input.setupUrl) {\n    manifest.setup_url = input.setupUrl;\n    manifest.setup_on_update = true;\n  }\n  return manifest;\n}\n\nexport function personalAppManifestUrl(state: string): string {\n  return `https://github.com/settings/apps/new?state=${state}`;\n}\n\nexport function organizationAppManifestUrl(organization: string, state: string): string {\n  return `https://github.com/organizations/${encodeURIComponent(organization)}/settings/apps/new?state=${state}`;\n}\n\nexport function githubOAuthAuthorizeUrl(input: {\n  clientId: string;\n  state: string;\n  redirectUri?: string;\n}): string {\n  const url = new URL(\"https://github.com/login/oauth/authorize\");\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"state\", input.state);\n  if (input.redirectUri) {\n    url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  }\n  return url.toString();\n}\n\nexport function createSignedState(\n  secret: string,\n  payloadOrNow: Record<string, unknown> | number = {},\n  nowArg = Math.floor(Date.now() / 1000),\n): string {\n  const payloadInput = typeof payloadOrNow === \"number\" ? {} : payloadOrNow;\n  const now = typeof payloadOrNow === \"number\" ? payloadOrNow : nowArg;\n  const payload = {\n    ...payloadInput,\n    nonce: randomBytes(16).toString(\"base64url\"),\n    iat: now,\n  };\n  const encoded = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  return `${encoded}.${signStatePayload(encoded, secret)}`;\n}\n\nexport function readSignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): GitHubSignedStatePayload | null {\n  const [encoded, signature] = state.split(\".\", 2);\n  if (!encoded || !signature) {\n    return null;\n  }\n  const expected = signStatePayload(encoded, secret);\n  if (!safeEqual(signature, expected)) {\n    return null;\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return null;\n  }\n  if (\n    !payload ||\n    typeof payload !== \"object\" ||\n    typeof (payload as { iat?: unknown }).iat !== \"number\" ||\n    typeof (payload as { nonce?: unknown }).nonce !== \"string\"\n  ) {\n    return null;\n  }\n  const age = now - (payload as { iat: number }).iat;\n  return age >= 0 && age <= stateMaxAgeSeconds ? (payload as GitHubSignedStatePayload) : null;\n}\n\nexport function verifySignedState(\n  state: string,\n  secret: string,\n  now = Math.floor(Date.now() / 1000),\n): boolean {\n  return readSignedState(state, secret, now) !== null;\n}\n\nexport function envLinesFromGitHubManifestConversion(payload: Record<string, unknown>): string[] {\n  const privateKey = String(payload.pem ?? \"\").replace(/\\n/g, \"\\\\n\");\n  return [\n    `OPENGENI_GITHUB_APP_ID=${payload.id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_ID=${payload.client_id ?? \"\"}`,\n    `OPENGENI_GITHUB_CLIENT_SECRET=${payload.client_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_SLUG=${payload.slug ?? \"\"}`,\n    `OPENGENI_GITHUB_WEBHOOK_SECRET=${payload.webhook_secret ?? \"\"}`,\n    `OPENGENI_GITHUB_APP_PRIVATE_KEY=\"${privateKey}\"`,\n  ];\n}\n\nexport async function convertGitHubAppManifest(code: string): Promise<Record<string, unknown>> {\n  const response = await fetch(`${githubApiBase}/app-manifests/${code}/conversions`, {\n    method: \"POST\",\n    headers: githubHeaders(undefined),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || Array.isArray(payload)) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid manifest conversion payload\");\n  }\n  return payload as Record<string, unknown>;\n}\n\nexport async function listGitHubAppInstallationSummaries(\n  settings: Settings,\n): Promise<GitHubAppInstallationSummary[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  return installations.map(installationSummaryFromPayload);\n}\n\nexport async function getGitHubAppInstallationSummary(\n  settings: Settings,\n  installationId: number,\n): Promise<GitHubAppInstallationSummary | null> {\n  const installations = await listGitHubAppInstallationSummaries(settings);\n  return (\n    installations.find((installation) => installation.installationId === installationId) ?? null\n  );\n}\n\nexport async function verifyGitHubInstallationAccessForUser(\n  settings: Settings,\n  input: {\n    code: string;\n    installationId: number;\n  },\n): Promise<GitHubAppInstallationSummary> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  const installation = installations.find(\n    (candidate) => candidate.installationId === input.installationId,\n  );\n  if (!installation) {\n    throw new GitHubAppApiError(\"GitHub installation is not accessible to the installing user\");\n  }\n  return installation;\n}\n\n/**\n * Exchange a GitHub App user-authorization code and discover the installations\n * and repositories the user can explicitly access. This is compatibility\n * discovery metadata only: visibility and repository permission bits do not\n * prove that the human may install, configure, or bind the App installation.\n * No production binding path may treat this result as authority.\n */\nexport async function authorizeGitHubAppUser(\n  settings: Settings,\n  input: { code: string },\n): Promise<GitHubUserInstallationAccess[]> {\n  const token = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const installations = await listUserAccessibleInstallations(token);\n  return await Promise.all(\n    installations.map(async (installation) => ({\n      ...installation,\n      repositories: installation.suspended\n        ? []\n        : await listUserInstallationRepositories(token, installation),\n    })),\n  );\n}\n\n/**\n * Prove current GitHub installation authority without treating repository\n * administration or installation visibility as delegation authority.\n *\n * GitHub exposes an exact personal-account owner through the authenticated\n * user's immutable id. For organizations, GitHub's authenticated membership\n * endpoint exposes active owners as role=admin. GitHub does not expose an\n * equivalent current-authority receipt for App Managers, so that case remains\n * unsupported and fails closed.\n */\nexport async function authorizeGitHubInstallationBinding(\n  settings: Settings,\n  input: { code: string; installationId: number },\n): Promise<GitHubInstallationBindingProof> {\n  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const actor = await getAuthenticatedGitHubUser(userToken);\n  const visibleInstallations = await listUserAccessibleInstallations(userToken);\n  const visible = visibleInstallations.find(\n    (installation) => installation.installationId === input.installationId,\n  );\n  if (!visible) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"GitHub did not associate this installation with the authorized user\",\n    );\n  }\n\n  const jwt = await createGitHubAppJwt(settings);\n  const livePayload = (await listInstallations(jwt)).find(\n    (installation) => asInt(installation.id) === input.installationId,\n  );\n  if (!livePayload) {\n    throw new GitHubInstallationAuthorityError(\n      \"installation_missing\",\n      \"GitHub App installation was deleted or is not owned by this App\",\n    );\n  }\n  const installation = installationSummaryFromPayload(livePayload);\n  if (\n    installation.accountId !== visible.accountId ||\n    installation.accountLogin !== visible.accountLogin ||\n    installation.accountType !== visible.accountType\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"GitHub installation identity changed during authorization\",\n    );\n  }\n  if (installation.suspended) {\n    throw new GitHubInstallationAuthorityError(\n      \"installation_suspended\",\n      \"GitHub App installation is suspended\",\n    );\n  }\n\n  let authorityKind: GitHubInstallationBindingProof[\"authorityKind\"];\n  if (installation.accountType === \"User\" && actor.id === installation.accountId) {\n    authorityKind = \"personal_owner\";\n  } else if (installation.accountType === \"Organization\" && installation.accountLogin) {\n    await assertActiveOrganizationOwner(\n      userToken,\n      installation.accountId,\n      installation.accountLogin,\n    );\n    authorityKind = \"organization_owner\";\n  } else {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"Only a GitHub personal-account owner or organization owner may bind an installation\",\n    );\n  }\n\n  const installationToken = await createInstallationToken(jwt, {\n    installationId: installation.installationId,\n  });\n  const repositories = await listInstallationRepositories(\n    installationToken.token,\n    installation.installationId,\n    { login: installation.accountLogin, type: installation.accountType },\n  );\n  if (repositories.length === 0) {\n    throw new GitHubInstallationAuthorityError(\n      \"repository_access_empty\",\n      \"GitHub App installation does not currently grant access to any repositories\",\n    );\n  }\n  if (authorityKind === \"organization_owner\") {\n    // Repository enumeration is an async provider boundary. Re-read the live\n    // owner tuple after it so a role revoked after the chooser proof cannot be\n    // durably bound with a later, misleading authority timestamp.\n    await assertActiveOrganizationOwner(\n      userToken,\n      installation.accountId,\n      installation.accountLogin!,\n    );\n  }\n  return {\n    actorId: actor.id,\n    actorLogin: actor.login,\n    authorityKind,\n    installation,\n    repositories,\n  };\n}\n\n/**\n * Discover existing installations that the freshly authorized GitHub human\n * can bind as an exact personal owner or active organization owner.\n *\n * `GET /user/installations` is discovery input only. Every candidate is\n * cross-checked against the App's live installation inventory and an\n * organization candidate requires a live `state=active, role=admin`\n * membership proof. The later exact authorization still re-runs the complete\n * proof immediately before the durable bind.\n */\nexport async function discoverGitHubInstallationBindingCandidates(\n  settings: Settings,\n  input: { code: string },\n): Promise<GitHubInstallationBindingCandidate[]> {\n  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);\n  const actor = await getAuthenticatedGitHubUser(userToken);\n  const visibleInstallations = await listUserAccessibleInstallations(userToken);\n  const jwt = await createGitHubAppJwt(settings);\n  const liveInstallations = new Map(\n    (await listInstallations(jwt)).map((payload) => {\n      const installation = installationSummaryFromPayload(payload);\n      return [installation.installationId, installation] as const;\n    }),\n  );\n  const candidates: GitHubInstallationBindingCandidate[] = [];\n\n  for (const visible of visibleInstallations) {\n    const installation = liveInstallations.get(visible.installationId);\n    if (\n      !installation ||\n      installation.suspended ||\n      installation.accountId !== visible.accountId ||\n      installation.accountLogin !== visible.accountLogin ||\n      installation.accountType !== visible.accountType\n    ) {\n      continue;\n    }\n    if (installation.accountType === \"User\" && actor.id === installation.accountId) {\n      candidates.push({ installation, authorityKind: \"personal_owner\" });\n      continue;\n    }\n    if (installation.accountType !== \"Organization\" || !installation.accountLogin) {\n      continue;\n    }\n    try {\n      await assertActiveOrganizationOwner(\n        userToken,\n        installation.accountId,\n        installation.accountLogin,\n      );\n      candidates.push({ installation, authorityKind: \"organization_owner\" });\n    } catch (error) {\n      if (\n        error instanceof GitHubInstallationAuthorityError &&\n        error.reason === \"authority_unavailable\"\n      ) {\n        continue;\n      }\n      if (\n        error instanceof GitHubInstallationAuthorityError &&\n        error.reason === \"authority_denied\"\n      ) {\n        continue;\n      }\n      throw error;\n    }\n  }\n\n  return candidates.sort((left, right) =>\n    (left.installation.accountLogin ?? \"\").localeCompare(right.installation.accountLogin ?? \"\"),\n  );\n}\n\nexport async function listGitHubAppRepositories(\n  settings: Settings,\n  input: {\n    installationIds?: number[];\n  } = {},\n): Promise<GitHubRepository[]> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  const allowedInstallations = input.installationIds ? new Set(input.installationIds) : null;\n  if (allowedInstallations && allowedInstallations.size === 0) {\n    return [];\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  const installations = await listInstallations(jwt);\n  const repositories: GitHubRepository[] = [];\n  for (const installation of installations) {\n    if (installation.suspended_at) {\n      continue;\n    }\n    const installationId = asInt(installation.id);\n    if (installationId === null) {\n      continue;\n    }\n    if (allowedInstallations && !allowedInstallations.has(installationId)) {\n      continue;\n    }\n    const account =\n      typeof installation.account === \"object\" && installation.account\n        ? (installation.account as Record<string, unknown>)\n        : {};\n    const token = await createInstallationToken(jwt, { installationId });\n    repositories.push(\n      ...(await listInstallationRepositories(token.token, installationId, account)),\n    );\n  }\n  repositories.sort((left, right) => left.fullName.localeCompare(right.fullName));\n  return repositories;\n}\n\nexport async function createGitHubAppInstallationToken(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds: number[];\n  },\n): Promise<string> {\n  return (await createGitHubAppInstallationTokenWithExpiry(settings, input)).token;\n}\n\nexport type GitHubAppInstallationToken = {\n  token: string;\n  expiresAt: string | null;\n};\n\nexport async function createGitHubAppInstallationTokenWithExpiry(\n  settings: Settings,\n  input: {\n    installationId: number;\n    repositoryIds: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const missing = githubAppMissingSettings(settings);\n  if (missing.length > 0) {\n    throw new GitHubAppConfigurationError(missing);\n  }\n  if (!Array.isArray(input.repositoryIds)) {\n    throw new GitHubAppApiError(\n      \"GitHub installation token mint requires an explicit, unique repository allowlist\",\n    );\n  }\n  const repositoryIds = [...new Set(input.repositoryIds)];\n  if (\n    !Number.isSafeInteger(input.installationId) ||\n    input.installationId <= 0 ||\n    repositoryIds.length === 0 ||\n    repositoryIds.length !== input.repositoryIds.length ||\n    repositoryIds.some((id) => !Number.isSafeInteger(id) || id <= 0)\n  ) {\n    throw new GitHubAppApiError(\n      \"GitHub installation token mint requires an explicit, unique repository allowlist\",\n    );\n  }\n  const jwt = await createGitHubAppJwt(settings);\n  return await createInstallationToken(jwt, {\n    installationId: input.installationId,\n    repositoryIds,\n  });\n}\n\nexport function githubAppBotIdentity(settings: Settings): { name: string; email: string } | null {\n  const appId = settings.githubAppId?.trim();\n  const slug = settings.githubAppSlug?.trim();\n  if (!appId || !slug) {\n    return null;\n  }\n  const login = `${slug}[bot]`;\n  return {\n    name: login,\n    email: `${appId}+${login}@users.noreply.github.com`,\n  };\n}\n\nasync function createGitHubAppJwt(settings: Settings): Promise<string> {\n  const privateKey = normalizeGitHubAppPrivateKey(settings.githubAppPrivateKey ?? \"\");\n  const appId = settings.githubAppId?.trim();\n  if (!appId || !privateKey) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const key = await importPKCS8(privateKey, \"RS256\");\n  const now = Math.floor(Date.now() / 1000);\n  return await new SignJWT({})\n    .setProtectedHeader({ alg: \"RS256\" })\n    .setIssuedAt(now - 60)\n    .setExpirationTime(now + 9 * 60)\n    .setIssuer(appId)\n    .sign(key);\n}\n\nasync function listInstallations(token: string): Promise<Array<Record<string, unknown>>> {\n  const out: Array<Record<string, unknown>> = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/app/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (!Array.isArray(payload)) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid installations payload\");\n    }\n    out.push(\n      ...payload.filter((item): item is Record<string, unknown> =>\n        Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n      ),\n    );\n    if (payload.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function exchangeGitHubOAuthCodeForUserToken(\n  settings: Settings,\n  code: string,\n): Promise<string> {\n  if (!settings.githubClientId || !settings.githubClientSecret) {\n    throw new GitHubAppConfigurationError(githubAppMissingSettings(settings));\n  }\n  const response = await fetch(\"https://github.com/login/oauth/access_token\", {\n    method: \"POST\",\n    headers: {\n      Accept: \"application/json\",\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      client_id: settings.githubClientId,\n      client_secret: settings.githubClientSecret,\n      code,\n    }),\n  });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.access_token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid OAuth token payload\");\n  }\n  return payload.access_token;\n}\n\nasync function getAuthenticatedGitHubUser(token: string): Promise<{ id: number; login: string }> {\n  const payload = await githubGet(\"/user\", token);\n  const id = payload && typeof payload === \"object\" ? asInt(payload.id) : null;\n  const login =\n    payload && typeof payload === \"object\" && typeof payload.login === \"string\"\n      ? payload.login\n      : null;\n  if (id === null || !login) {\n    throw new GitHubAppApiError(\"GitHub returned an invalid authenticated user payload\");\n  }\n  return { id, login };\n}\n\nasync function getAuthenticatedOrganizationMembership(\n  token: string,\n  organizationLogin: string,\n): Promise<{ organizationId: number; role: string; state: string }> {\n  let payload: any;\n  try {\n    payload = await githubGet(\n      `/user/memberships/orgs/${encodeURIComponent(organizationLogin)}`,\n      token,\n    );\n  } catch (error) {\n    if (error instanceof GitHubAppApiError) {\n      throw new GitHubInstallationAuthorityError(\n        \"authority_unavailable\",\n        \"GitHub could not prove current organization-owner membership\",\n        error.status,\n      );\n    }\n    throw error;\n  }\n  const organization =\n    payload && typeof payload === \"object\" && payload.organization ? payload.organization : null;\n  const organizationId =\n    organization && typeof organization === \"object\" ? asInt(organization.id) : null;\n  if (\n    organizationId === null ||\n    typeof payload?.role !== \"string\" ||\n    typeof payload?.state !== \"string\"\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_unavailable\",\n      \"GitHub returned an invalid organization membership proof\",\n    );\n  }\n  return { organizationId, role: payload.role, state: payload.state };\n}\n\nasync function assertActiveOrganizationOwner(\n  token: string,\n  organizationId: number,\n  organizationLogin: string,\n): Promise<void> {\n  const membership = await getAuthenticatedOrganizationMembership(token, organizationLogin);\n  if (\n    membership.organizationId !== organizationId ||\n    membership.state !== \"active\" ||\n    membership.role !== \"admin\"\n  ) {\n    throw new GitHubInstallationAuthorityError(\n      \"authority_denied\",\n      \"Only an active GitHub organization owner may bind this installation\",\n    );\n  }\n}\n\nasync function listUserAccessibleInstallations(\n  token: string,\n): Promise<GitHubAppInstallationSummary[]> {\n  const out: GitHubAppInstallationSummary[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/user/installations\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    const installations: unknown[] | null =\n      payload && typeof payload === \"object\" && Array.isArray(payload.installations)\n        ? (payload.installations as unknown[])\n        : null;\n    if (!installations) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid user installations payload\");\n    }\n    out.push(\n      ...installations\n        .filter((item): item is Record<string, unknown> =>\n          Boolean(item && typeof item === \"object\" && !Array.isArray(item)),\n        )\n        .map(installationSummaryFromPayload),\n    );\n    if (installations.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function listUserInstallationRepositories(\n  token: string,\n  installation: GitHubAppInstallationSummary,\n): Promise<GitHubUserRepositoryAccess[]> {\n  const out: GitHubUserRepositoryAccess[] = [];\n  const account = {\n    ...(installation.accountLogin ? { login: installation.accountLogin } : {}),\n    ...(installation.accountType ? { type: installation.accountType } : {}),\n  };\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\n      `/user/installations/${installation.installationId}/repositories`,\n      token,\n      { per_page: \"100\", page: String(page) },\n    );\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\n        \"GitHub returned an invalid user installation repositories payload\",\n      );\n    }\n    for (const repository of payload.repositories) {\n      if (!repository || typeof repository !== \"object\" || Array.isArray(repository)) {\n        continue;\n      }\n      const record = repository as Record<string, unknown>;\n      out.push({\n        ...repositoryFromPayload(record, installation.installationId, account),\n        permissions: repositoryPermissionsFromPayload(record.permissions),\n      });\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nasync function createInstallationToken(\n  appJwt: string,\n  input: {\n    installationId: number;\n    repositoryIds?: number[];\n  },\n): Promise<GitHubAppInstallationToken> {\n  const scoped = input.repositoryIds && input.repositoryIds.length > 0;\n  const response = await fetch(\n    `${githubApiBase}/app/installations/${input.installationId}/access_tokens`,\n    {\n      method: \"POST\",\n      headers: {\n        ...githubHeaders(appJwt),\n        ...(scoped ? { \"Content-Type\": \"application/json\" } : {}),\n      },\n      signal: AbortSignal.timeout(githubTokenMintTimeoutMs),\n      ...(scoped ? { body: JSON.stringify({ repository_ids: input.repositoryIds }) } : {}),\n    },\n  );\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response));\n  }\n  const payload = await response.json();\n  if (!payload || typeof payload !== \"object\" || typeof payload.token !== \"string\") {\n    throw new GitHubAppApiError(\"GitHub returned an invalid installation token payload\");\n  }\n  return {\n    token: payload.token,\n    expiresAt: typeof payload.expires_at === \"string\" ? payload.expires_at : null,\n  };\n}\n\nasync function listInstallationRepositories(\n  token: string,\n  installationId: number,\n  account: Record<string, unknown>,\n): Promise<GitHubRepository[]> {\n  const out: GitHubRepository[] = [];\n  for (let page = 1; ; page += 1) {\n    const payload = await githubGet(\"/installation/repositories\", token, {\n      per_page: \"100\",\n      page: String(page),\n    });\n    if (\n      !payload ||\n      typeof payload !== \"object\" ||\n      Array.isArray(payload) ||\n      !Array.isArray(payload.repositories)\n    ) {\n      throw new GitHubAppApiError(\"GitHub returned an invalid repositories payload\");\n    }\n    for (const repo of payload.repositories) {\n      if (repo && typeof repo === \"object\" && !Array.isArray(repo)) {\n        out.push(repositoryFromPayload(repo as Record<string, unknown>, installationId, account));\n      }\n    }\n    if (payload.repositories.length < 100) {\n      return out;\n    }\n  }\n}\n\nfunction installationSummaryFromPayload(\n  payload: Record<string, unknown>,\n): GitHubAppInstallationSummary {\n  const installationId = asInt(payload.id);\n  if (installationId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without id\");\n  }\n  const account =\n    typeof payload.account === \"object\" && payload.account\n      ? (payload.account as Record<string, unknown>)\n      : {};\n  const accountId = asInt(account.id);\n  if (accountId === null) {\n    throw new GitHubAppApiError(\"GitHub returned an installation without an account id\");\n  }\n  return {\n    installationId,\n    accountId,\n    accountLogin: typeof account.login === \"string\" ? account.login : null,\n    accountType: typeof account.type === \"string\" ? account.type : null,\n    suspended: Boolean(payload.suspended_at),\n  };\n}\n\nasync function githubGet(\n  path: string,\n  token: string,\n  params: Record<string, string> = {},\n): Promise<any> {\n  const url = new URL(`${githubApiBase}${path}`);\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, value);\n  }\n  const response = await fetch(url, { headers: githubHeaders(token) });\n  if (!response.ok) {\n    throw new GitHubAppApiError(await githubErrorMessage(response), response.status);\n  }\n  return await response.json();\n}\n\nfunction repositoryFromPayload(\n  payload: Record<string, unknown>,\n  installationId: number,\n  account: Record<string, unknown>,\n): GitHubRepository {\n  const id = asInt(payload.id);\n  const fullName = String(payload.full_name ?? \"\");\n  if (id === null || !fullName) {\n    throw new GitHubAppApiError(\"GitHub returned a repository without id/full_name\");\n  }\n  return {\n    id,\n    installationId,\n    fullName,\n    name: String(payload.name ?? fullName.split(\"/\").at(-1) ?? fullName),\n    private: Boolean(payload.private),\n    htmlUrl: String(payload.html_url ?? `https://github.com/${fullName}`),\n    cloneUrl: String(payload.clone_url ?? `https://github.com/${fullName}.git`),\n    defaultBranch: String(payload.default_branch ?? \"main\"),\n    accountLogin: String(account.login ?? fullName.split(\"/\", 1)[0]),\n    accountType: typeof account.type === \"string\" ? account.type : null,\n  };\n}\n\nfunction repositoryPermissionsFromPayload(payload: unknown): GitHubRepositoryPermissions {\n  const permissions =\n    payload && typeof payload === \"object\" && !Array.isArray(payload)\n      ? (payload as Record<string, unknown>)\n      : {};\n  return {\n    admin: permissions.admin === true,\n    maintain: permissions.maintain === true,\n    push: permissions.push === true,\n    triage: permissions.triage === true,\n    pull: permissions.pull === true,\n  };\n}\n\nfunction githubHeaders(token?: string): HeadersInit {\n  return {\n    Accept: \"application/vnd.github+json\",\n    ...(token ? { Authorization: `Bearer ${token}` } : {}),\n    \"X-GitHub-Api-Version\": githubApiVersion,\n  };\n}\n\nasync function githubErrorMessage(response: Response): Promise<string> {\n  try {\n    const payload = await response.json();\n    if (payload && typeof payload === \"object\" && \"message\" in payload) {\n      return `GitHub API ${response.status}: ${String(payload.message)}`;\n    }\n  } catch {\n    // fall through\n  }\n  return `GitHub API ${response.status}: ${await response.text()}`;\n}\n\nexport function normalizeGitHubAppPrivateKey(value: string): string {\n  const privateKey = value.trim().replace(/\\\\n/g, \"\\n\");\n  if (!privateKey || privateKey.startsWith(pkcs8PrivateKeyHeader)) {\n    return privateKey;\n  }\n  if (privateKey.startsWith(rsaPrivateKeyHeader)) {\n    return createPrivateKey(privateKey).export({ type: \"pkcs8\", format: \"pem\" }).toString();\n  }\n  return privateKey;\n}\n\nfunction signStatePayload(encoded: string, secret: string): string {\n  return createHmac(\"sha256\", secret).update(encoded).digest(\"base64url\");\n}\n\nfunction safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction asInt(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value)) {\n    return value;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value)) {\n    return Number(value);\n  }\n  return null;\n}\n"],"mappings":";AASA,SAAS,YAAY,kBAAkB,aAAa,uBAAuB;AAC3E,SAAS,SAAS,mBAAmB;AAErC,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,2BAA2B;AAC1B,IAAM,qBAAqB,KAAK;AACvC,IAAM,wBAAwB,cAAc,aAAa;AACzD,IAAM,sBAAsB,cAAc,iBAAiB;AAEpD,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAqB,SAAmB;AACtC,UAAM,8BAA8B;AADjB;AAAA,EAErB;AACF;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YACE,SACS,SAAwB,MACjC;AACA,UAAM,OAAO;AAFJ;AAAA,EAGX;AACF;AASO,IAAM,mCAAN,cAA+C,kBAAkB;AAAA,EACtE,YACW,QACT,SACA,SAAwB,MACxB;AACA,UAAM,SAAS,MAAM;AAJZ;AAAA,EAKX;AACF;AAkBO,SAAS,yBAAyB,UAA8B;AACrE,QAAM,WAA+C;AAAA,IACnD,wBAAwB,SAAS;AAAA,IACjC,2BAA2B,SAAS;AAAA,IACpC,+BAA+B,SAAS;AAAA,IACxC,0BAA0B,SAAS;AAAA,IACnC,iCAAiC,SAAS;AAAA,EAC5C;AACA,SAAO,OAAO,QAAQ,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAO,SAAS,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE;AAClG;AAEO,SAAS,uBAAuB,OAMX;AAC1B,QAAM,OAAO,MAAM,QAAQ,QAAQ,QAAQ,EAAE;AAC7C,QAAM,cAAsC;AAAA,IAC1C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,eAAe;AAAA;AAAA;AAAA;AAAA,IAIf,SAAS;AAAA,EACX;AACA,MAAI,MAAM,sBAAsB;AAC9B,gBAAY,UAAU;AACtB,gBAAY,SAAS;AACrB,gBAAY,WAAW;AAAA,EACzB;AACA,QAAM,WAAoC;AAAA,IACxC,MAAM,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,cAAc,GAAG,IAAI;AAAA,IACrB,eAAe,CAAC,GAAG,IAAI,2BAA2B;AAAA,IAClD,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA,IAId,0BAA0B,CAAC,MAAM;AAAA,IACjC,qBAAqB;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,aAAS,YAAY,MAAM;AAC3B,aAAS,kBAAkB;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAuB;AAC5D,SAAO,8CAA8C,KAAK;AAC5D;AAEO,SAAS,2BAA2B,cAAsB,OAAuB;AACtF,SAAO,oCAAoC,mBAAmB,YAAY,CAAC,4BAA4B,KAAK;AAC9G;AAEO,SAAS,wBAAwB,OAI7B;AACT,QAAM,MAAM,IAAI,IAAI,0CAA0C;AAC9D,MAAI,aAAa,IAAI,aAAa,MAAM,QAAQ;AAChD,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,MAAI,MAAM,aAAa;AACrB,QAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;AAAA,EACxD;AACA,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,kBACd,QACA,eAAiD,CAAC,GAClD,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC7B;AACR,QAAM,eAAe,OAAO,iBAAiB,WAAW,CAAC,IAAI;AAC7D,QAAM,MAAM,OAAO,iBAAiB,WAAW,eAAe;AAC9D,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,IAC3C,KAAK;AAAA,EACP;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AACzE,SAAO,GAAG,OAAO,IAAI,iBAAiB,SAAS,MAAM,CAAC;AACxD;AAEO,SAAS,gBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACD;AACjC,QAAM,CAAC,SAAS,SAAS,IAAI,MAAM,MAAM,KAAK,CAAC;AAC/C,MAAI,CAAC,WAAW,CAAC,WAAW;AAC1B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,iBAAiB,SAAS,MAAM;AACjD,MAAI,CAAC,UAAU,WAAW,QAAQ,GAAG;AACnC,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,CAAC,WACD,OAAO,YAAY,YACnB,OAAQ,QAA8B,QAAQ,YAC9C,OAAQ,QAAgC,UAAU,UAClD;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAO,QAA4B;AAC/C,SAAO,OAAO,KAAK,OAAO,qBAAsB,UAAuC;AACzF;AAEO,SAAS,kBACd,OACA,QACA,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACzB;AACT,SAAO,gBAAgB,OAAO,QAAQ,GAAG,MAAM;AACjD;AAEO,SAAS,qCAAqC,SAA4C;AAC/F,QAAM,aAAa,OAAO,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,KAAK;AACjE,SAAO;AAAA,IACL,0BAA0B,QAAQ,MAAM,EAAE;AAAA,IAC1C,6BAA6B,QAAQ,aAAa,EAAE;AAAA,IACpD,iCAAiC,QAAQ,iBAAiB,EAAE;AAAA,IAC5D,4BAA4B,QAAQ,QAAQ,EAAE;AAAA,IAC9C,kCAAkC,QAAQ,kBAAkB,EAAE;AAAA,IAC9D,oCAAoC,UAAU;AAAA,EAChD;AACF;AAEA,eAAsB,yBAAyB,MAAgD;AAC7F,QAAM,WAAW,MAAM,MAAM,GAAG,aAAa,kBAAkB,IAAI,gBAAgB;AAAA,IACjF,QAAQ;AAAA,IACR,SAAS,cAAc,MAAS;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,UAAM,IAAI,kBAAkB,wDAAwD;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,mCACpB,UACyC;AACzC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,SAAO,cAAc,IAAI,8BAA8B;AACzD;AAEA,eAAsB,gCACpB,UACA,gBAC8C;AAC9C,QAAM,gBAAgB,MAAM,mCAAmC,QAAQ;AACvE,SACE,cAAc,KAAK,CAAC,iBAAiB,aAAa,mBAAmB,cAAc,KAAK;AAE5F;AAEA,eAAsB,sCACpB,UACA,OAIuC;AACvC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,QAAM,eAAe,cAAc;AAAA,IACjC,CAAC,cAAc,UAAU,mBAAmB,MAAM;AAAA,EACpD;AACA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,kBAAkB,8DAA8D;AAAA,EAC5F;AACA,SAAO;AACT;AASA,eAAsB,uBACpB,UACA,OACyC;AACzC,QAAM,QAAQ,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAC5E,QAAM,gBAAgB,MAAM,gCAAgC,KAAK;AACjE,SAAO,MAAM,QAAQ;AAAA,IACnB,cAAc,IAAI,OAAO,kBAAkB;AAAA,MACzC,GAAG;AAAA,MACH,cAAc,aAAa,YACvB,CAAC,IACD,MAAM,iCAAiC,OAAO,YAAY;AAAA,IAChE,EAAE;AAAA,EACJ;AACF;AAYA,eAAsB,mCACpB,UACA,OACyC;AACzC,QAAM,YAAY,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAChF,QAAM,QAAQ,MAAM,2BAA2B,SAAS;AACxD,QAAM,uBAAuB,MAAM,gCAAgC,SAAS;AAC5E,QAAM,UAAU,qBAAqB;AAAA,IACnC,CAACA,kBAAiBA,cAAa,mBAAmB,MAAM;AAAA,EAC1D;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,eAAe,MAAM,kBAAkB,GAAG,GAAG;AAAA,IACjD,CAACA,kBAAiB,MAAMA,cAAa,EAAE,MAAM,MAAM;AAAA,EACrD;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,+BAA+B,WAAW;AAC/D,MACE,aAAa,cAAc,QAAQ,aACnC,aAAa,iBAAiB,QAAQ,gBACtC,aAAa,gBAAgB,QAAQ,aACrC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,aAAa,WAAW;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,aAAa,gBAAgB,UAAU,MAAM,OAAO,aAAa,WAAW;AAC9E,oBAAgB;AAAA,EAClB,WAAW,aAAa,gBAAgB,kBAAkB,aAAa,cAAc;AACnF,UAAM;AAAA,MACJ;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AACA,oBAAgB;AAAA,EAClB,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,MAAM,wBAAwB,KAAK;AAAA,IAC3D,gBAAgB,aAAa;AAAA,EAC/B,CAAC;AACD,QAAM,eAAe,MAAM;AAAA,IACzB,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,EAAE,OAAO,aAAa,cAAc,MAAM,aAAa,YAAY;AAAA,EACrE;AACA,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,sBAAsB;AAI1C,UAAM;AAAA,MACJ;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAYA,eAAsB,4CACpB,UACA,OAC+C;AAC/C,QAAM,YAAY,MAAM,oCAAoC,UAAU,MAAM,IAAI;AAChF,QAAM,QAAQ,MAAM,2BAA2B,SAAS;AACxD,QAAM,uBAAuB,MAAM,gCAAgC,SAAS;AAC5E,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,oBAAoB,IAAI;AAAA,KAC3B,MAAM,kBAAkB,GAAG,GAAG,IAAI,CAAC,YAAY;AAC9C,YAAM,eAAe,+BAA+B,OAAO;AAC3D,aAAO,CAAC,aAAa,gBAAgB,YAAY;AAAA,IACnD,CAAC;AAAA,EACH;AACA,QAAM,aAAmD,CAAC;AAE1D,aAAW,WAAW,sBAAsB;AAC1C,UAAM,eAAe,kBAAkB,IAAI,QAAQ,cAAc;AACjE,QACE,CAAC,gBACD,aAAa,aACb,aAAa,cAAc,QAAQ,aACnC,aAAa,iBAAiB,QAAQ,gBACtC,aAAa,gBAAgB,QAAQ,aACrC;AACA;AAAA,IACF;AACA,QAAI,aAAa,gBAAgB,UAAU,MAAM,OAAO,aAAa,WAAW;AAC9E,iBAAW,KAAK,EAAE,cAAc,eAAe,iBAAiB,CAAC;AACjE;AAAA,IACF;AACA,QAAI,aAAa,gBAAgB,kBAAkB,CAAC,aAAa,cAAc;AAC7E;AAAA,IACF;AACA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA,aAAa;AAAA,QACb,aAAa;AAAA,MACf;AACA,iBAAW,KAAK,EAAE,cAAc,eAAe,qBAAqB,CAAC;AAAA,IACvE,SAAS,OAAO;AACd,UACE,iBAAiB,oCACjB,MAAM,WAAW,yBACjB;AACA;AAAA,MACF;AACA,UACE,iBAAiB,oCACjB,MAAM,WAAW,oBACjB;AACA;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO,WAAW;AAAA,IAAK,CAAC,MAAM,WAC3B,KAAK,aAAa,gBAAgB,IAAI,cAAc,MAAM,aAAa,gBAAgB,EAAE;AAAA,EAC5F;AACF;AAEA,eAAsB,0BACpB,UACA,QAEI,CAAC,GACwB;AAC7B,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,QAAM,uBAAuB,MAAM,kBAAkB,IAAI,IAAI,MAAM,eAAe,IAAI;AACtF,MAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC3D,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,QAAM,gBAAgB,MAAM,kBAAkB,GAAG;AACjD,QAAM,eAAmC,CAAC;AAC1C,aAAW,gBAAgB,eAAe;AACxC,QAAI,aAAa,cAAc;AAC7B;AAAA,IACF;AACA,UAAM,iBAAiB,MAAM,aAAa,EAAE;AAC5C,QAAI,mBAAmB,MAAM;AAC3B;AAAA,IACF;AACA,QAAI,wBAAwB,CAAC,qBAAqB,IAAI,cAAc,GAAG;AACrE;AAAA,IACF;AACA,UAAM,UACJ,OAAO,aAAa,YAAY,YAAY,aAAa,UACpD,aAAa,UACd,CAAC;AACP,UAAM,QAAQ,MAAM,wBAAwB,KAAK,EAAE,eAAe,CAAC;AACnE,iBAAa;AAAA,MACX,GAAI,MAAM,6BAA6B,MAAM,OAAO,gBAAgB,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,eAAa,KAAK,CAAC,MAAM,UAAU,KAAK,SAAS,cAAc,MAAM,QAAQ,CAAC;AAC9E,SAAO;AACT;AAEA,eAAsB,iCACpB,UACA,OAIiB;AACjB,UAAQ,MAAM,2CAA2C,UAAU,KAAK,GAAG;AAC7E;AAOA,eAAsB,2CACpB,UACA,OAIqC;AACrC,QAAM,UAAU,yBAAyB,QAAQ;AACjD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,4BAA4B,OAAO;AAAA,EAC/C;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,aAAa,GAAG;AACvC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,MAAM,aAAa,CAAC;AACtD,MACE,CAAC,OAAO,cAAc,MAAM,cAAc,KAC1C,MAAM,kBAAkB,KACxB,cAAc,WAAW,KACzB,cAAc,WAAW,MAAM,cAAc,UAC7C,cAAc,KAAK,CAAC,OAAO,CAAC,OAAO,cAAc,EAAE,KAAK,MAAM,CAAC,GAC/D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,MAAM,mBAAmB,QAAQ;AAC7C,SAAO,MAAM,wBAAwB,KAAK;AAAA,IACxC,gBAAgB,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qBAAqB,UAA4D;AAC/F,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,QAAM,OAAO,SAAS,eAAe,KAAK;AAC1C,MAAI,CAAC,SAAS,CAAC,MAAM;AACnB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,GAAG,IAAI;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,GAAG,KAAK,IAAI,KAAK;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,QAAM,aAAa,6BAA6B,SAAS,uBAAuB,EAAE;AAClF,QAAM,QAAQ,SAAS,aAAa,KAAK;AACzC,MAAI,CAAC,SAAS,CAAC,YAAY;AACzB,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,MAAM,MAAM,YAAY,YAAY,OAAO;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,EACxB,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,MAAM,EAAE,EACpB,kBAAkB,MAAM,IAAI,EAAE,EAC9B,UAAU,KAAK,EACf,KAAK,GAAG;AACb;AAEA,eAAe,kBAAkB,OAAwD;AACvF,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,sBAAsB,OAAO;AAAA,MAC3D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,YAAM,IAAI,kBAAkB,kDAAkD;AAAA,IAChF;AACA,QAAI;AAAA,MACF,GAAG,QAAQ;AAAA,QAAO,CAAC,SACjB,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAK;AACxB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,oCACb,UACA,MACiB;AACjB,MAAI,CAAC,SAAS,kBAAkB,CAAC,SAAS,oBAAoB;AAC5D,UAAM,IAAI,4BAA4B,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AACA,QAAM,WAAW,MAAM,MAAM,+CAA+C;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,eAAe,SAAS;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,iBAAiB,UAAU;AACvF,UAAM,IAAI,kBAAkB,gDAAgD;AAAA,EAC9E;AACA,SAAO,QAAQ;AACjB;AAEA,eAAe,2BAA2B,OAAuD;AAC/F,QAAM,UAAU,MAAM,UAAU,SAAS,KAAK;AAC9C,QAAM,KAAK,WAAW,OAAO,YAAY,WAAW,MAAM,QAAQ,EAAE,IAAI;AACxE,QAAM,QACJ,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,WAC/D,QAAQ,QACR;AACN,MAAI,OAAO,QAAQ,CAAC,OAAO;AACzB,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO,EAAE,IAAI,MAAM;AACrB;AAEA,eAAe,uCACb,OACA,mBACkE;AAClE,MAAI;AACJ,MAAI;AACF,cAAU,MAAM;AAAA,MACd,0BAA0B,mBAAmB,iBAAiB,CAAC;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,mBAAmB;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,eACJ,WAAW,OAAO,YAAY,YAAY,QAAQ,eAAe,QAAQ,eAAe;AAC1F,QAAM,iBACJ,gBAAgB,OAAO,iBAAiB,WAAW,MAAM,aAAa,EAAE,IAAI;AAC9E,MACE,mBAAmB,QACnB,OAAO,SAAS,SAAS,YACzB,OAAO,SAAS,UAAU,UAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,gBAAgB,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM;AACpE;AAEA,eAAe,8BACb,OACA,gBACA,mBACe;AACf,QAAM,aAAa,MAAM,uCAAuC,OAAO,iBAAiB;AACxF,MACE,WAAW,mBAAmB,kBAC9B,WAAW,UAAU,YACrB,WAAW,SAAS,SACpB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gCACb,OACyC;AACzC,QAAM,MAAsC,CAAC;AAC7C,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,uBAAuB,OAAO;AAAA,MAC5D,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,UAAM,gBACJ,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,QAAQ,aAAa,IACxE,QAAQ,gBACT;AACN,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,kBAAkB,uDAAuD;AAAA,IACrF;AACA,QAAI;AAAA,MACF,GAAG,cACA;AAAA,QAAO,CAAC,SACP,QAAQ,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClE,EACC,IAAI,8BAA8B;AAAA,IACvC;AACA,QAAI,cAAc,SAAS,KAAK;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,iCACb,OACA,cACuC;AACvC,QAAM,MAAoC,CAAC;AAC3C,QAAM,UAAU;AAAA,IACd,GAAI,aAAa,eAAe,EAAE,OAAO,aAAa,aAAa,IAAI,CAAC;AAAA,IACxE,GAAI,aAAa,cAAc,EAAE,MAAM,aAAa,YAAY,IAAI,CAAC;AAAA,EACvE;AACA,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM;AAAA,MACpB,uBAAuB,aAAa,cAAc;AAAA,MAClD;AAAA,MACA,EAAE,UAAU,OAAO,MAAM,OAAO,IAAI,EAAE;AAAA,IACxC;AACA,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,eAAW,cAAc,QAAQ,cAAc;AAC7C,UAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AAC9E;AAAA,MACF;AACA,YAAM,SAAS;AACf,UAAI,KAAK;AAAA,QACP,GAAG,sBAAsB,QAAQ,aAAa,gBAAgB,OAAO;AAAA,QACrE,aAAa,iCAAiC,OAAO,WAAW;AAAA,MAClE,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAe,wBACb,QACA,OAIqC;AACrC,QAAM,SAAS,MAAM,iBAAiB,MAAM,cAAc,SAAS;AACnE,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,aAAa,sBAAsB,MAAM,cAAc;AAAA,IAC1D;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,GAAG,cAAc,MAAM;AAAA,QACvB,GAAI,SAAS,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,MACzD;AAAA,MACA,QAAQ,YAAY,QAAQ,wBAAwB;AAAA,MACpD,GAAI,SAAS,EAAE,MAAM,KAAK,UAAU,EAAE,gBAAgB,MAAM,cAAc,CAAC,EAAE,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,CAAC;AAAA,EAChE;AACA,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,QAAQ,UAAU,UAAU;AAChF,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf,WAAW,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,EAC3E;AACF;AAEA,eAAe,6BACb,OACA,gBACA,SAC6B;AAC7B,QAAM,MAA0B,CAAC;AACjC,WAAS,OAAO,KAAK,QAAQ,GAAG;AAC9B,UAAM,UAAU,MAAM,UAAU,8BAA8B,OAAO;AAAA,MACnE,UAAU;AAAA,MACV,MAAM,OAAO,IAAI;AAAA,IACnB,CAAC;AACD,QACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,CAAC,MAAM,QAAQ,QAAQ,YAAY,GACnC;AACA,YAAM,IAAI,kBAAkB,iDAAiD;AAAA,IAC/E;AACA,eAAW,QAAQ,QAAQ,cAAc;AACvC,UAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AAC5D,YAAI,KAAK,sBAAsB,MAAiC,gBAAgB,OAAO,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS,KAAK;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,+BACP,SAC8B;AAC9B,QAAM,iBAAiB,MAAM,QAAQ,EAAE;AACvC,MAAI,mBAAmB,MAAM;AAC3B,UAAM,IAAI,kBAAkB,4CAA4C;AAAA,EAC1E;AACA,QAAM,UACJ,OAAO,QAAQ,YAAY,YAAY,QAAQ,UAC1C,QAAQ,UACT,CAAC;AACP,QAAM,YAAY,MAAM,QAAQ,EAAE;AAClC,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,kBAAkB,uDAAuD;AAAA,EACrF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAClE,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IAC/D,WAAW,QAAQ,QAAQ,YAAY;AAAA,EACzC;AACF;AAEA,eAAe,UACb,MACA,OACA,SAAiC,CAAC,GACpB;AACd,QAAM,MAAM,IAAI,IAAI,GAAG,aAAa,GAAG,IAAI,EAAE;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,QAAM,WAAW,MAAM,MAAM,KAAK,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AACnE,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,kBAAkB,MAAM,mBAAmB,QAAQ,GAAG,SAAS,MAAM;AAAA,EACjF;AACA,SAAO,MAAM,SAAS,KAAK;AAC7B;AAEA,SAAS,sBACP,SACA,gBACA,SACkB;AAClB,QAAM,KAAK,MAAM,QAAQ,EAAE;AAC3B,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAC/C,MAAI,OAAO,QAAQ,CAAC,UAAU;AAC5B,UAAM,IAAI,kBAAkB,mDAAmD;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,QAAQ,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,QAAQ;AAAA,IACnE,SAAS,QAAQ,QAAQ,OAAO;AAAA,IAChC,SAAS,OAAO,QAAQ,YAAY,sBAAsB,QAAQ,EAAE;AAAA,IACpE,UAAU,OAAO,QAAQ,aAAa,sBAAsB,QAAQ,MAAM;AAAA,IAC1E,eAAe,OAAO,QAAQ,kBAAkB,MAAM;AAAA,IACtD,cAAc,OAAO,QAAQ,SAAS,SAAS,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,IAC/D,aAAa,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,EACjE;AACF;AAEA,SAAS,iCAAiC,SAA+C;AACvF,QAAM,cACJ,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3D,UACD,CAAC;AACP,SAAO;AAAA,IACL,OAAO,YAAY,UAAU;AAAA,IAC7B,UAAU,YAAY,aAAa;AAAA,IACnC,MAAM,YAAY,SAAS;AAAA,IAC3B,QAAQ,YAAY,WAAW;AAAA,IAC/B,MAAM,YAAY,SAAS;AAAA,EAC7B;AACF;AAEA,SAAS,cAAc,OAA6B;AAClD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,GAAI,QAAQ,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,CAAC;AAAA,IACpD,wBAAwB;AAAA,EAC1B;AACF;AAEA,eAAe,mBAAmB,UAAqC;AACrE,MAAI;AACF,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,QAAI,WAAW,OAAO,YAAY,YAAY,aAAa,SAAS;AAClE,aAAO,cAAc,SAAS,MAAM,KAAK,OAAO,QAAQ,OAAO,CAAC;AAAA,IAClE;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,cAAc,SAAS,MAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAChE;AAEO,SAAS,6BAA6B,OAAuB;AAClE,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,QAAQ,IAAI;AACpD,MAAI,CAAC,cAAc,WAAW,WAAW,qBAAqB,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,MAAI,WAAW,WAAW,mBAAmB,GAAG;AAC9C,WAAO,iBAAiB,UAAU,EAAE,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,QAAwB;AACjE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW;AACxE;AAEA,SAAS,UAAU,MAAc,OAAwB;AACvD,QAAM,IAAI,OAAO,KAAK,IAAI;AAC1B,QAAM,IAAI,OAAO,KAAK,KAAK;AAC3B,SAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAEA,SAAS,MAAM,OAA+B;AAC5C,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,GAAG;AACpD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;","names":["installation"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/github",
-  "version": "0.3.22",
+  "version": "0.4.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -31,8 +31,8 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/config": "^0.7.10",
-    "@opengeni/contracts": "^0.21.0",
+    "@opengeni/config": "^0.7.13",
+    "@opengeni/contracts": "^0.23.0",
     "jose": "^6.1.3"
   }
 }

package/src/index.ts

@@ -1,5 +1,6 @@
 import type { Settings } from "@opengeni/config";
 import type {
+  GitHubInstallationBindingCandidate,
   GitHubInstallationBindingProof,
   GitHubRepository,
   GitHubRepositoryPermissions,
@@ -103,7 +104,10 @@ export function buildGitHubAppManifest(input: {
     redirect_url: `${base}/v1/github/app-manifest/callback`,
     callback_urls: [`${base}/v1/github/oauth/callback`],
     public: input.public,
-    request_oauth_on_install: true,
+    // A setup URL and OAuth-on-install are mutually exclusive in GitHub's App
+    // contract. OpenGeni needs the setup callback to receive the installation
+    // id, then starts its own exact user-authorization flow.
+    request_oauth_on_install: !input.setupUrl,
     default_permissions: permissions,
   };
   if (input.setupUrl) {
@@ -385,6 +389,79 @@ export async function authorizeGitHubInstallationBinding(
   };
 }
 
+/**
+ * Discover existing installations that the freshly authorized GitHub human
+ * can bind as an exact personal owner or active organization owner.
+ *
+ * `GET /user/installations` is discovery input only. Every candidate is
+ * cross-checked against the App's live installation inventory and an
+ * organization candidate requires a live `state=active, role=admin`
+ * membership proof. The later exact authorization still re-runs the complete
+ * proof immediately before the durable bind.
+ */
+export async function discoverGitHubInstallationBindingCandidates(
+  settings: Settings,
+  input: { code: string },
+): Promise<GitHubInstallationBindingCandidate[]> {
+  const userToken = await exchangeGitHubOAuthCodeForUserToken(settings, input.code);
+  const actor = await getAuthenticatedGitHubUser(userToken);
+  const visibleInstallations = await listUserAccessibleInstallations(userToken);
+  const jwt = await createGitHubAppJwt(settings);
+  const liveInstallations = new Map(
+    (await listInstallations(jwt)).map((payload) => {
+      const installation = installationSummaryFromPayload(payload);
+      return [installation.installationId, installation] as const;
+    }),
+  );
+  const candidates: GitHubInstallationBindingCandidate[] = [];
+
+  for (const visible of visibleInstallations) {
+    const installation = liveInstallations.get(visible.installationId);
+    if (
+      !installation ||
+      installation.suspended ||
+      installation.accountId !== visible.accountId ||
+      installation.accountLogin !== visible.accountLogin ||
+      installation.accountType !== visible.accountType
+    ) {
+      continue;
+    }
+    if (installation.accountType === "User" && actor.id === installation.accountId) {
+      candidates.push({ installation, authorityKind: "personal_owner" });
+      continue;
+    }
+    if (installation.accountType !== "Organization" || !installation.accountLogin) {
+      continue;
+    }
+    try {
+      await assertActiveOrganizationOwner(
+        userToken,
+        installation.accountId,
+        installation.accountLogin,
+      );
+      candidates.push({ installation, authorityKind: "organization_owner" });
+    } catch (error) {
+      if (
+        error instanceof GitHubInstallationAuthorityError &&
+        error.reason === "authority_unavailable"
+      ) {
+        continue;
+      }
+      if (
+        error instanceof GitHubInstallationAuthorityError &&
+        error.reason === "authority_denied"
+      ) {
+        continue;
+      }
+      throw error;
+    }
+  }
+
+  return candidates.sort((left, right) =>
+    (left.installation.accountLogin ?? "").localeCompare(right.installation.accountLogin ?? ""),
+  );
+}
+
 export async function listGitHubAppRepositories(
   settings: Settings,
   input: {