@theholocron/github-client 1.31.0 → 1.32.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/github-client",
-  "version": "1.31.0",
+  "version": "1.32.0",
   "description": "A TypeScript client for the GitHub REST API",
   "keywords": [
     "github",
@@ -33,13 +33,13 @@
   ],
   "dependencies": {
     "@theholocron/observability": "^0.3.0",
-    "@theholocron/http-client": "^1.31.0"
+    "@theholocron/http-client": "^1.32.0"
   },
   "devDependencies": {
-    "@theholocron/cli": "5.0.0-alpha.33",
+    "@theholocron/cli": "5.0.0-alpha.79",
     "@theholocron/eslint-config": "^8.4.3",
     "@theholocron/tsconfig": "^8.2.0",
-    "@theholocron/tsdown-config": "^8.2.0",
+    "@theholocron/tsdown-config": "^8.5.2",
     "@theholocron/vitest-config": "^8.2.0",
     "@types/node": "^26.4.1",
     "@vitest/coverage-v8": "^5.0.0",
@@ -61,7 +61,7 @@
   "releases": "https://github.com/theholocron/clients/releases",
   "wiki": "https://github.com/theholocron/clients/wiki",
   "scripts": {
-    "delivery.build": "tsdown",
+    "delivery.build": "holocron run delivery.build -- && node ../../scripts/check-bundle-size.mjs",
     "sourceQuality.staticAnalysis": "holocron run sourceQuality.staticAnalysis --",
     "test:watch": "vitest",
     "verification.typeSafety": "holocron run verification.typeSafety --",

package/dist/index.d.mts

@@ -1,512 +0,0 @@
-import "@theholocron/http-client";
-import { ErrorSink, Logger } from "@theholocron/observability/core";
-//#region src/utils.d.ts
-interface GitHubClientOptions {
-  token: string;
-  baseUrl?: string;
-  fetch?: typeof fetch;
-  /** Structured logger for request/response diagnostics. Defaults to a no-op. */
-  logger?: Logger;
-  /** Reports transport failures and unexpected 5xx. Defaults to a no-op. */
-  errors?: ErrorSink;
-}
-//#endregion
-//#region src/checks/checks.d.ts
-type CheckRunStatus = "queued" | "in_progress" | "completed";
-type CheckRunConclusion = "success" | "failure" | "neutral" | "cancelled" | "timed_out" | "action_required" | "skipped";
-type CheckRunAnnotationLevel = "notice" | "warning" | "failure";
-interface CheckRunAnnotation {
-  /** File path relative to the repo root. */
-  path: string;
-  /** 1-indexed. */
-  start_line: number;
-  end_line: number;
-  /** Only valid when `start_line === end_line`. */
-  start_column?: number;
-  end_column?: number;
-  annotation_level: CheckRunAnnotationLevel;
-  /** Max 64KB. */
-  message: string;
-  /** Max 255 characters. */
-  title?: string;
-  /** Max 64KB. */
-  raw_details?: string;
-}
-interface CheckRunOutput {
-  title: string;
-  summary: string;
-  text?: string;
-  /**
-   * Inline PR annotations — up to 50 per request. Sending more requires a
-   * follow-up `updateCheckRun()` PATCH per GitHub's own docs; this client
-   * doesn't paginate them for you.
-   */
-  annotations?: CheckRunAnnotation[];
-}
-interface CreateCheckRunInput {
-  name: string;
-  /** The commit SHA the check run attaches to. */
-  head_sha: string;
-  /** Defaults to `"queued"` (GitHub's own default) when omitted. */
-  status?: CheckRunStatus;
-  /** Required when `status` is `"completed"`. */
-  conclusion?: CheckRunConclusion;
-  output?: CheckRunOutput;
-  /** URL for the "Details" link on the check run. GitHub defaults to the check suite's own summary page when omitted. */
-  details_url?: string;
-}
-interface GitHubCheckRun {
-  id: number;
-  name: string;
-  head_sha: string;
-  status: CheckRunStatus;
-  conclusion: CheckRunConclusion | null;
-  html_url: string;
-}
-interface UpdateCheckRunInput {
-  status?: CheckRunStatus;
-  /** Required when `status` is `"completed"`. */
-  conclusion?: CheckRunConclusion;
-  output?: CheckRunOutput;
-  /** URL for the "Details" link on the check run. */
-  details_url?: string;
-}
-//#endregion
-//#region src/environments/environments.d.ts
-interface GitHubEnvironment {
-  name: string;
-  wait_timer?: number;
-  prevent_self_review?: boolean;
-  protection_rules?: Array<{
-    type: string;
-    reviewers?: Array<{
-      type: "User" | "Team";
-      reviewer: {
-        id: number;
-      };
-    }>;
-  }>;
-}
-//#endregion
-//#region src/git/git.d.ts
-interface GitRef {
-  object: {
-    sha: string;
-    type: string;
-    url: string;
-  };
-  ref: string;
-  url: string;
-}
-interface GitCommit {
-  sha: string;
-  tree: {
-    sha: string;
-    url: string;
-  };
-}
-interface GitTreeItem {
-  path: string;
-  sha: string;
-  type: string;
-  mode?: string;
-  size?: number;
-}
-interface GitTree {
-  sha: string;
-  tree: GitTreeItem[];
-  truncated: boolean;
-}
-interface GitContents {
-  content: string;
-  encoding: string;
-  sha: string;
-  name: string;
-  path: string;
-}
-interface GitBlob {
-  sha: string;
-  url: string;
-}
-interface GitPull {
-  number: number;
-  html_url: string;
-  title: string;
-}
-interface CreatePullInput {
-  title: string;
-  head: string;
-  base: string;
-  body?: string;
-}
-//#endregion
-//#region src/issues/issues.d.ts
-interface GitHubIssue {
-  id: number;
-  number: number;
-  title: string;
-  body?: string | null;
-  state: "open" | "closed";
-  labels: Array<{
-    name: string;
-  }>;
-  assignee: {
-    login: string;
-    name?: string | null;
-    email?: string | null;
-  } | null;
-  updated_at: string;
-  html_url: string;
-  pull_request?: unknown;
-}
-interface GitHubMilestone {
-  number: number;
-  title: string;
-}
-interface IssueSearchParams {
-  state?: "open" | "closed" | "all";
-  sort?: string;
-  direction?: string;
-  per_page?: number;
-  filter?: string;
-  assignee?: string;
-}
-//#endregion
-//#region src/labels/labels.d.ts
-interface GitHubLabel {
-  name: string;
-  color: string;
-  description: string | null;
-}
-//#endregion
-//#region src/pages/pages.d.ts
-type PagesBuildType = "workflow" | "legacy";
-type PagesBuildStatus = "built" | "building" | "errored" | "unknown";
-interface GitHubPages {
-  status: PagesBuildStatus | null;
-  build_type: PagesBuildType | null;
-  source?: {
-    branch: string;
-    path: string;
-  };
-  https_enforced: boolean;
-  custom_domain: string | null;
-}
-interface CreatePagesPayload {
-  build_type: PagesBuildType;
-  /** Required when build_type is "legacy". */
-  source?: {
-    branch: string;
-    path: string;
-  };
-}
-interface UpdatePagesPayload {
-  build_type?: PagesBuildType;
-  source?: {
-    branch: string;
-    path: string;
-  };
-  cname?: string | null;
-  https_enforced?: boolean;
-}
-//#endregion
-//#region src/pulls/pulls.d.ts
-interface GitHubPullRequest {
-  number: number;
-  title: string;
-  state: "open" | "closed";
-  merged_at: string | null;
-  html_url: string;
-  head: {
-    ref: string;
-  };
-}
-/** One commit as returned by `GET /pulls/{pull_number}/commits` — only the fields any known consumer needs. */
-interface GitHubPullRequestCommit {
-  sha: string;
-  commit: {
-    message: string;
-  };
-}
-/** One file as returned by `GET /pulls/{pull_number}/files` — only the fields any known consumer needs. */
-interface GitHubPullRequestFile {
-  filename: string;
-  status: "added" | "removed" | "modified" | "renamed" | "copied" | "changed" | "unchanged";
-  /** Set only when `status === "renamed"`. */
-  previous_filename?: string;
-}
-//#endregion
-//#region src/repos/repos.d.ts
-interface GitHubRepo {
-  default_branch: string;
-  full_name: string;
-}
-interface GitHubContents {
-  content: string;
-  encoding: string;
-}
-//#endregion
-//#region src/rulesets/rulesets.d.ts
-interface GitHubRuleset {
-  id: number;
-  name: string;
-  enforcement: string;
-}
-//#endregion
-//#region src/secrets/secrets.d.ts
-type SecretScope = {
-  kind: "repo";
-} | {
-  kind: "environment";
-  name: string;
-} | {
-  kind: "organization";
-  org: string;
-};
-interface GitHubPublicKey {
-  key_id: string;
-  key: string;
-}
-//#endregion
-//#region src/security/security.d.ts
-interface CodeScanningSetupResult {
-  run_id: number;
-  run_url: string;
-}
-//#endregion
-//#region src/teams/teams.d.ts
-type TeamPermission = "pull" | "triage" | "push" | "maintain" | "admin";
-//#endregion
-//#region src/user/user.d.ts
-interface GitHubUser {
-  login: string;
-  name: string | null;
-  email: string | null;
-}
-//#endregion
-//#region src/workflows/workflows.d.ts
-interface GitHubWorkflowRun {
-  id: number;
-  name: string | null;
-  display_title: string;
-  head_branch: string;
-  head_sha: string;
-  status: string;
-  conclusion: string | null;
-  html_url: string;
-  created_at: string;
-  updated_at: string;
-}
-interface WorkflowRunFilter {
-  branch?: string;
-  limit?: number;
-  status?: string;
-}
-//#endregion
-//#region src/app-auth/app-auth.d.ts
-interface GitHubAppCredentials {
-  /** The App's numeric id (not the client id). */
-  appId: string;
-  /** PEM-encoded RSA private key — PKCS#1 (GitHub's default download format) or PKCS#8, either works. */
-  privateKey: string;
-}
-interface InstallationAccessToken {
-  token: string;
-  /** ISO 8601 — installation tokens are short-lived, about an hour. */
-  expiresAt: string;
-}
-/**
- * Signs a JWT identifying this App (not a specific installation) — the
- * credential used only to request an installation access token, never
- * to call the REST API directly.
- */
-declare function createAppJWT(creds: GitHubAppCredentials, now?: number): Promise<string>;
-/**
- * Exchanges an App JWT for an installation access token — the credential
- * that actually authenticates REST calls, scoped to exactly one
- * installation (D10: never a hardcoded org — the caller supplies which
- * installation, from the webhook payload that triggered this).
- */
-declare function getInstallationAccessToken(creds: GitHubAppCredentials, installationId: number, opts?: Pick<GitHubClientOptions, "baseUrl" | "fetch">): Promise<InstallationAccessToken>;
-/** The whole flow in one call — an already-authenticated `GitHubClient` scoped to one installation. */
-declare function createInstallationClient(creds: GitHubAppCredentials, installationId: number, opts?: Pick<GitHubClientOptions, "baseUrl" | "fetch">): Promise<GitHubClient>;
-//#endregion
-//#region src/webhooks/webhooks.d.ts
-/**
- * GitHub's own webhook mechanics — signature verification and header/
- * payload shapes. Pure functions, no REST call, no auth token: these
- * operate on an *inbound* delivery, the mirror of everything else this
- * package does (outbound REST calls), so they're standalone exports
- * rather than part of `createGitHubClient()`'s returned object.
- *
- * A consumer (a GitHub App receiving webhooks) owns what to *do* with a
- * verified delivery — which event categories matter, how to normalize
- * them — the same split `holocron-plugin-clerk`'s `parseWebhook` draws
- * between Svix verification and Clerk-specific `AuthEvent` normalization,
- * just with the verification half living here instead of inline, since
- * "how GitHub signs and shapes a webhook" is vendor knowledge this
- * package already owns for every other GitHub API surface.
- */
-/**
- * Verifies a GitHub webhook delivery's `X-Hub-Signature-256` header —
- * HMAC-SHA256 over the raw body, keyed by the webhook's configured
- * secret, `timingSafeEqual`-compared.
- * https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
- *
- * Returns `false` (never throws) for any failure to verify — a missing/
- * empty secret, a missing/malformed signature header, or a mismatch —
- * so the caller decides how to surface that (e.g. as its own error type).
- */
-declare function verifyGitHubWebhookSignature(input: {
-  body: string | Buffer;
-  signature: string | undefined;
-  secret: string;
-}): boolean;
-interface GitHubWebhookHeaders {
-  /** `X-GitHub-Event` — the event category, e.g. `"push"`, `"pull_request"`. */
-  event: string | undefined;
-  /** `X-GitHub-Delivery` — GitHub's per-delivery id, useful for idempotency/logging. */
-  delivery: string | undefined;
-  /** `X-Hub-Signature-256` — pass straight to `verifyGitHubWebhookSignature`. */
-  signature: string | undefined;
-}
-/** Extracts GitHub's three webhook headers, case-insensitively (Node's raw headers may arrive lower-cased, or as an array when a header repeats). */
-declare function parseGitHubWebhookHeaders(headers: Record<string, string | string[] | undefined>): GitHubWebhookHeaders;
-interface GitHubInstallationWebhookPayload {
-  action: string;
-  installation: {
-    id: number;
-  };
-}
-interface GitHubPushWebhookPayload {
-  ref: string;
-  installation?: {
-    id: number;
-  };
-  repository: {
-    full_name: string;
-    default_branch: string;
-  };
-}
-interface GitHubPullRequestWebhookPayload {
-  action: string;
-  installation?: {
-    id: number;
-  };
-  repository: {
-    full_name: string;
-  };
-}
-//#endregion
-//#region src/index.d.ts
-declare function createGitHubClient(opts: GitHubClientOptions): {
-  branches: {
-    protectBranch: (repo: string, branch: string, payload: Record<string, unknown>) => Promise<void>;
-  };
-  checks: {
-    createCheckRun: (repo: string, input: CreateCheckRunInput) => Promise<GitHubCheckRun>;
-    updateCheckRun: (repo: string, checkRunId: number, input: UpdateCheckRunInput) => Promise<GitHubCheckRun>;
-  };
-  environments: {
-    listEnvironments: (repo: string) => Promise<GitHubEnvironment[]>;
-    upsertEnvironment: (repo: string, name: string, body: Record<string, unknown>) => Promise<void>;
-    deleteEnvironment: (repo: string, name: string) => Promise<void>;
-  };
-  git: {
-    getRef: (repo: string, branch: string) => Promise<GitRef>;
-    getCommit: (repo: string, sha: string) => Promise<GitCommit>;
-    getTree: (repo: string, sha: string, recursive?: boolean) => Promise<GitTree>;
-    getContents: (repo: string, path: string, ref?: string) => Promise<GitContents>;
-    createBlob: (repo: string, content: string, encoding?: string) => Promise<GitBlob>;
-    createTree: (repo: string, tree: Array<{
-      path: string;
-      mode: string;
-      type: string;
-      sha: string;
-    }>, baseTree?: string) => Promise<GitTree>;
-    createCommit: (repo: string, message: string, tree: string, parents: string[]) => Promise<GitCommit>;
-    createRef: (repo: string, ref: string, sha: string) => Promise<GitRef>;
-    updateRef: (repo: string, ref: string, sha: string, force?: boolean) => Promise<GitRef>;
-    createPull: (repo: string, input: CreatePullInput) => Promise<GitPull>;
-  };
-  issues: {
-    listIssues: (repo: string, params?: IssueSearchParams) => Promise<GitHubIssue[]>;
-    getIssue: (repo: string, number: number) => Promise<GitHubIssue>;
-    createIssue: (repo: string, body: Record<string, unknown>) => Promise<GitHubIssue>;
-    updateIssue: (repo: string, number: number, body: Record<string, unknown>) => Promise<GitHubIssue>;
-    addLabels: (repo: string, number: number, labels: string[]) => Promise<void>;
-    removeLabel: (repo: string, number: number, label: string) => Promise<void>;
-    createComment: (repo: string, number: number, body: string) => Promise<void>;
-    listMilestones: (repo: string, params?: {
-      state?: "open" | "closed" | "all";
-    }) => Promise<GitHubMilestone[]>;
-  };
-  labels: {
-    listLabels: (repo: string) => Promise<GitHubLabel[]>;
-    createLabel: (repo: string, body: {
-      name: string;
-      color: string;
-      description: string;
-    }) => Promise<GitHubLabel>;
-    updateLabel: (repo: string, name: string, body: {
-      color?: string;
-      description?: string;
-    }) => Promise<GitHubLabel>;
-    deleteLabel: (repo: string, name: string) => Promise<void>;
-  };
-  pages: {
-    getPages: (repo: string) => Promise<GitHubPages | null>;
-    createPages: (repo: string, payload: CreatePagesPayload) => Promise<GitHubPages>;
-    updatePages: (repo: string, payload: UpdatePagesPayload) => Promise<void>;
-  };
-  properties: {
-    setProperties: (repo: string, values: Record<string, string | string[]>) => Promise<void>;
-  };
-  pulls: {
-    getPullRequest: (repo: string, number: number) => Promise<GitHubPullRequest>;
-    listCommits: (repo: string, number: number) => Promise<GitHubPullRequestCommit[]>;
-    listFiles: (repo: string, number: number) => Promise<GitHubPullRequestFile[]>;
-  };
-  repos: {
-    getRepo: (repo: string) => Promise<GitHubRepo>;
-    updateRepo: (repo: string, settings: Record<string, unknown>) => Promise<void>;
-    getContents: (repo: string, path: string) => Promise<GitHubContents>;
-  };
-  rulesets: {
-    listRulesets: (repo: string) => Promise<GitHubRuleset[]>;
-    createRuleset: (repo: string, payload: Record<string, unknown>) => Promise<GitHubRuleset>;
-    updateRuleset: (repo: string, id: number, payload: Record<string, unknown>) => Promise<GitHubRuleset>;
-  };
-  secrets: {
-    listSecrets: (repo: string, scope: SecretScope) => Promise<string[]>;
-    getPublicKey: (repo: string, scope: SecretScope) => Promise<GitHubPublicKey>;
-    putSecret: (repo: string, scope: SecretScope, name: string, body: Record<string, unknown>) => Promise<void>;
-    deleteSecret: (repo: string, scope: SecretScope, name: string) => Promise<void>;
-  };
-  security: {
-    enableVulnerabilityAlerts: (repo: string) => Promise<void>;
-    enableAutomatedSecurityFixes: (repo: string) => Promise<void>;
-    enableSecretScanning: (repo: string) => Promise<void>;
-    enablePrivateVulnerabilityReporting: (repo: string) => Promise<void>;
-    enableDependencyGraph: (repo: string) => Promise<void>;
-    enableCodeScanning: (repo: string) => Promise<CodeScanningSetupResult>;
-    disableDefaultCodeScanning: (repo: string) => Promise<void>;
-  };
-  teams: {
-    addRepo: (org: string, teamSlug: string, owner: string, repo: string, permission: TeamPermission) => Promise<void>;
-  };
-  topics: {
-    setTopics: (repo: string, names: string[]) => Promise<void>;
-  };
-  user: {
-    getCurrentUser: () => Promise<GitHubUser>;
-  };
-  workflows: {
-    listRuns: (repo: string, filter?: WorkflowRunFilter) => Promise<GitHubWorkflowRun[]>;
-    getRun: (repo: string, id: string | number) => Promise<GitHubWorkflowRun>;
-    createWorkflowDispatch: (repo: string, workflowFile: string, ref: string, inputs?: Record<string, string>) => Promise<void>;
-  };
-};
-type GitHubClient = ReturnType<typeof createGitHubClient>;
-//#endregion
-export { type CheckRunAnnotation, type CheckRunAnnotationLevel, type CheckRunConclusion, type CheckRunOutput, type CheckRunStatus, type CodeScanningSetupResult, type CreateCheckRunInput, type CreatePagesPayload, type CreatePullInput, type GitBlob, type GitCommit, type GitContents, type GitHubAppCredentials, type GitHubCheckRun, GitHubClient, type GitHubClientOptions, type GitHubContents, type GitHubEnvironment, type GitHubInstallationWebhookPayload, type GitHubIssue, type GitHubLabel, type GitHubMilestone, type GitHubPages, type GitHubPublicKey, type GitHubPullRequest, type GitHubPullRequestCommit, type GitHubPullRequestFile, type GitHubPullRequestWebhookPayload, type GitHubPushWebhookPayload, type GitHubRepo, type GitHubRuleset, type GitHubUser, type GitHubWebhookHeaders, type GitHubWorkflowRun, type GitPull, type GitRef, type GitTree, type GitTreeItem, type InstallationAccessToken, type IssueSearchParams, type PagesBuildStatus, type PagesBuildType, type SecretScope, type TeamPermission, type UpdateCheckRunInput, type UpdatePagesPayload, type WorkflowRunFilter, createAppJWT, createGitHubClient, createInstallationClient, getInstallationAccessToken, parseGitHubWebhookHeaders, verifyGitHubWebhookSignature };

package/dist/index.mjs

@@ -1,631 +0,0 @@
-import { ProviderApiError, createRestClient } from "@theholocron/http-client";
-import { createHmac, timingSafeEqual } from "node:crypto";
-//#region src/utils.ts
-function createGitHubRestClient(opts) {
-	return createRestClient({
-		baseUrl: opts.baseUrl ?? "https://api.github.com",
-		token: opts.token,
-		extraHeaders: {
-			accept: "application/vnd.github+json",
-			"x-github-api-version": "2022-11-28"
-		},
-		vendor: "GitHub",
-		fetch: opts.fetch,
-		logger: opts.logger,
-		errors: opts.errors
-	});
-}
-/** `/repos/owner/name` prefix from a `"owner/name"` repo string. */
-function repoBase(repo) {
-	const [owner, name] = repo.split("/", 2);
-	return `/repos/${owner}/${name}`;
-}
-//#endregion
-//#region src/branches/branches.ts
-function branches(rest) {
-	return { protectBranch: (repo, branch, payload) => rest.request(`${repoBase(repo)}/branches/${encodeURIComponent(branch)}/protection`, {
-		method: "PUT",
-		body: payload
-	}) };
-}
-//#endregion
-//#region src/checks/checks.ts
-function checks(rest) {
-	return {
-		createCheckRun: (repo, input) => rest.request(`${repoBase(repo)}/check-runs`, {
-			method: "POST",
-			body: input
-		}),
-		/** Patches an existing check run — used to move a `"queued"` run posted before a dispatched task ran to `"completed"` once it finishes. */
-		updateCheckRun: (repo, checkRunId, input) => rest.request(`${repoBase(repo)}/check-runs/${checkRunId}`, {
-			method: "PATCH",
-			body: input
-		})
-	};
-}
-//#endregion
-//#region src/environments/environments.ts
-function environments(rest) {
-	return {
-		listEnvironments: (repo) => rest.request(`${repoBase(repo)}/environments`).then((r) => r.environments),
-		upsertEnvironment: (repo, name, body) => rest.request(`${repoBase(repo)}/environments/${encodeURIComponent(name)}`, {
-			method: "PUT",
-			body
-		}),
-		deleteEnvironment: (repo, name) => rest.request(`${repoBase(repo)}/environments/${encodeURIComponent(name)}`, {
-			method: "DELETE",
-			expectNoContent: true
-		})
-	};
-}
-//#endregion
-//#region src/git/git.ts
-function git(rest) {
-	return {
-		getRef: (repo, branch) => rest.request(`${repoBase(repo)}/git/ref/heads/${branch}`),
-		getCommit: (repo, sha) => rest.request(`${repoBase(repo)}/git/commits/${sha}`),
-		getTree: (repo, sha, recursive = false) => rest.request(`${repoBase(repo)}/git/trees/${sha}${recursive ? "?recursive=1" : ""}`),
-		/**
-		* `ref` defaults to the repo's default branch (GitHub's own default)
-		* when omitted — the security-relevant choice every existing caller
-		* relies on (D4/D6, `validateConfig()`'s own docstring). Pass it
-		* explicitly to read a specific commit/branch's content instead — a
-		* same-repo PR branch is no longer a new trust boundary for this org
-		* (D6-amended, `tech-sentinel-ci-runner.spec.md`), just never a fork's.
-		*/
-		getContents: (repo, path, ref) => rest.request(`${repoBase(repo)}/contents/${path}`, ref ? { query: { ref } } : void 0),
-		createBlob: (repo, content, encoding = "utf-8") => rest.request(`${repoBase(repo)}/git/blobs`, {
-			method: "POST",
-			body: {
-				content,
-				encoding
-			}
-		}),
-		createTree: (repo, tree, baseTree) => rest.request(`${repoBase(repo)}/git/trees`, {
-			method: "POST",
-			body: {
-				base_tree: baseTree,
-				tree
-			}
-		}),
-		createCommit: (repo, message, tree, parents) => rest.request(`${repoBase(repo)}/git/commits`, {
-			method: "POST",
-			body: {
-				message,
-				tree,
-				parents
-			}
-		}),
-		createRef: (repo, ref, sha) => rest.request(`${repoBase(repo)}/git/refs`, {
-			method: "POST",
-			body: {
-				ref,
-				sha
-			}
-		}),
-		updateRef: (repo, ref, sha, force = false) => rest.request(`${repoBase(repo)}/git/refs/${ref}`, {
-			method: "PATCH",
-			body: {
-				sha,
-				force
-			}
-		}),
-		createPull: (repo, input) => rest.request(`${repoBase(repo)}/pulls`, {
-			method: "POST",
-			body: input
-		})
-	};
-}
-//#endregion
-//#region src/issues/issues.ts
-function issues(rest) {
-	return {
-		listIssues: (repo, params = {}) => {
-			const qs = new URLSearchParams();
-			if (params.state) qs.set("state", params.state);
-			if (params.sort) qs.set("sort", params.sort);
-			if (params.direction) qs.set("direction", params.direction);
-			if (params.per_page) qs.set("per_page", String(params.per_page));
-			if (params.filter) qs.set("filter", params.filter);
-			if (params.assignee) qs.set("assignee", params.assignee);
-			const q = qs.toString();
-			const path = q ? `${repoBase(repo)}/issues?${q}` : `${repoBase(repo)}/issues`;
-			return rest.request(path);
-		},
-		getIssue: (repo, number) => rest.request(`${repoBase(repo)}/issues/${number}`),
-		createIssue: (repo, body) => rest.request(`${repoBase(repo)}/issues`, {
-			method: "POST",
-			body
-		}),
-		updateIssue: (repo, number, body) => rest.request(`${repoBase(repo)}/issues/${number}`, {
-			method: "PATCH",
-			body
-		}),
-		addLabels: (repo, number, labels) => rest.request(`${repoBase(repo)}/issues/${number}/labels`, {
-			method: "POST",
-			body: { labels }
-		}),
-		removeLabel: (repo, number, label) => rest.request(`${repoBase(repo)}/issues/${number}/labels/${encodeURIComponent(label)}`, { method: "DELETE" }),
-		createComment: (repo, number, body) => rest.request(`${repoBase(repo)}/issues/${number}/comments`, {
-			method: "POST",
-			body: { body }
-		}),
-		listMilestones: (repo, params = {}) => {
-			const qs = new URLSearchParams({ per_page: "100" });
-			if (params.state) qs.set("state", params.state);
-			return rest.request(`${repoBase(repo)}/milestones?${qs.toString()}`);
-		}
-	};
-}
-//#endregion
-//#region src/labels/labels.ts
-function labels(rest) {
-	return {
-		listLabels: (repo) => rest.request(`${repoBase(repo)}/labels?per_page=100`),
-		createLabel: (repo, body) => rest.request(`${repoBase(repo)}/labels`, {
-			method: "POST",
-			body
-		}),
-		updateLabel: (repo, name, body) => rest.request(`${repoBase(repo)}/labels/${encodeURIComponent(name)}`, {
-			method: "PATCH",
-			body
-		}),
-		deleteLabel: (repo, name) => rest.request(`${repoBase(repo)}/labels/${encodeURIComponent(name)}`, { method: "DELETE" })
-	};
-}
-//#endregion
-//#region src/pages/pages.ts
-function pages(rest) {
-	return {
-		/** Returns null when Pages is not yet enabled (404). */
-		getPages: async (repo) => {
-			try {
-				return await rest.request(`${repoBase(repo)}/pages`);
-			} catch (err) {
-				if (err instanceof ProviderApiError && err.status === 404) return null;
-				throw err;
-			}
-		},
-		/**
-		* Enables Pages for the first time.
-		* Throws on all errors except 409 Conflict (already enabled — callers
-		* should catch that and fall through to updatePages).
-		*/
-		createPages: (repo, payload) => rest.request(`${repoBase(repo)}/pages`, {
-			method: "POST",
-			body: payload
-		}),
-		/**
-		* Updates Pages settings on an existing site (build type, cname, https).
-		* GitHub returns 204 No Content.
-		*/
-		updatePages: (repo, payload) => rest.request(`${repoBase(repo)}/pages`, {
-			method: "PUT",
-			body: payload
-		})
-	};
-}
-//#endregion
-//#region src/properties/properties.ts
-function properties(rest) {
-	return { 
-	/**
-	* `value` is a plain string for `string`/`single_select`/`true_false`
-	* custom properties, or a string array for `multi_select` ones —
-	* GitHub's own PATCH body accepts either per property. A single-string
-	* comma-joined value has no length ceiling GitHub documents, but real
-	* usage hits one in practice (a `string`-type property with enough
-	* joined values 422s as "too long"); `multi_select` has none.
-	*/
-setProperties: (repo, values) => {
-		const propertyList = Object.entries(values).map(([property_name, value]) => ({
-			property_name,
-			value
-		}));
-		return rest.request(`${repoBase(repo)}/properties/values`, {
-			method: "PATCH",
-			body: { properties: propertyList }
-		});
-	} };
-}
-//#endregion
-//#region src/pulls/pulls.ts
-function pulls(rest) {
-	return {
-		getPullRequest: (repo, number) => rest.request(`${repoBase(repo)}/pulls/${number}`),
-		/**
-		* A PR's own commits, in commit order. `per_page=100` — GitHub's max —
-		* covers every real PR in this org; a PR genuinely exceeding 100
-		* commits (GitHub caps this endpoint at 250 regardless of pagination)
-		* is an edge case no consumer here needs to paginate for today.
-		*/
-		listCommits: (repo, number) => rest.request(`${repoBase(repo)}/pulls/${number}/commits?per_page=100`),
-		/**
-		* A PR's own changed files. `per_page=100` — GitHub's max — covers
-		* every real PR in this org; a PR genuinely exceeding 100 changed
-		* files (GitHub caps this endpoint at 3000 regardless of pagination)
-		* is an edge case no consumer here needs to paginate for today.
-		*/
-		listFiles: (repo, number) => rest.request(`${repoBase(repo)}/pulls/${number}/files?per_page=100`)
-	};
-}
-//#endregion
-//#region src/repos/repos.ts
-function repos(rest) {
-	return {
-		getRepo: (repo) => rest.request(repoBase(repo)),
-		updateRepo: (repo, settings) => rest.request(repoBase(repo), {
-			method: "PATCH",
-			body: settings
-		}),
-		getContents: (repo, path) => rest.request(`${repoBase(repo)}/contents/${path}`)
-	};
-}
-//#endregion
-//#region src/rulesets/rulesets.ts
-function rulesets(rest) {
-	return {
-		listRulesets: (repo) => rest.request(`${repoBase(repo)}/rulesets`),
-		createRuleset: (repo, payload) => rest.request(`${repoBase(repo)}/rulesets`, {
-			method: "POST",
-			body: payload
-		}),
-		updateRuleset: (repo, id, payload) => rest.request(`${repoBase(repo)}/rulesets/${id}`, {
-			method: "PUT",
-			body: payload
-		})
-	};
-}
-//#endregion
-//#region src/secrets/secrets.ts
-function scopeBase(repo, scope) {
-	switch (scope.kind) {
-		case "repo": return `${repoBase(repo)}/actions`;
-		case "environment": return `${repoBase(repo)}/environments/${scope.name}`;
-		case "organization": return `/orgs/${scope.org}/actions`;
-	}
-}
-function secrets(rest) {
-	return {
-		listSecrets: (repo, scope) => rest.request(`${scopeBase(repo, scope)}/secrets`).then((r) => r.secrets.map((s) => s.name)),
-		getPublicKey: (repo, scope) => rest.request(`${scopeBase(repo, scope)}/secrets/public-key`),
-		putSecret: (repo, scope, name, body) => rest.request(`${scopeBase(repo, scope)}/secrets/${name}`, {
-			method: "PUT",
-			body,
-			expectNoContent: true
-		}),
-		deleteSecret: (repo, scope, name) => rest.request(`${scopeBase(repo, scope)}/secrets/${name}`, {
-			method: "DELETE",
-			expectNoContent: true
-		})
-	};
-}
-//#endregion
-//#region src/security/security.ts
-function security(rest) {
-	return {
-		enableVulnerabilityAlerts: (repo) => rest.request(`${repoBase(repo)}/vulnerability-alerts`, {
-			method: "PUT",
-			expectNoContent: true
-		}),
-		enableAutomatedSecurityFixes: (repo) => rest.request(`${repoBase(repo)}/automated-security-fixes`, {
-			method: "PUT",
-			expectNoContent: true
-		}),
-		enableSecretScanning: (repo) => rest.request(repoBase(repo), {
-			method: "PATCH",
-			body: { security_and_analysis: {
-				secret_scanning: { status: "enabled" },
-				secret_scanning_push_protection: { status: "enabled" },
-				secret_scanning_validity_checks: { status: "enabled" },
-				secret_scanning_non_provider_patterns: { status: "enabled" }
-			} }
-		}),
-		enablePrivateVulnerabilityReporting: (repo) => rest.request(`${repoBase(repo)}/private-vulnerability-reporting`, {
-			method: "PUT",
-			expectNoContent: true
-		}),
-		enableDependencyGraph: (repo) => rest.request(repoBase(repo), {
-			method: "PATCH",
-			body: { security_and_analysis: {
-				dependency_graph: { status: "enabled" },
-				dependency_graph_autosubmit_action: { status: "enabled" }
-			} }
-		}),
-		enableCodeScanning: (repo) => rest.request(`${repoBase(repo)}/code-scanning/default-setup`, {
-			method: "PATCH",
-			body: {
-				state: "configured",
-				query_suite: "extended",
-				threat_model: "remote_and_local"
-			}
-		}),
-		disableDefaultCodeScanning: (repo) => rest.request(`${repoBase(repo)}/code-scanning/default-setup`, {
-			method: "PATCH",
-			body: { state: "not-configured" }
-		})
-	};
-}
-//#endregion
-//#region src/teams/teams.ts
-function teams(rest) {
-	return { addRepo: (org, teamSlug, owner, repo, permission) => rest.request(`/orgs/${org}/teams/${teamSlug}/repos/${owner}/${repo}`, {
-		method: "PUT",
-		body: { permission }
-	}) };
-}
-//#endregion
-//#region src/topics/topics.ts
-function topics(rest) {
-	return { setTopics: (repo, names) => rest.request(`${repoBase(repo)}/topics`, {
-		method: "PUT",
-		body: { names }
-	}) };
-}
-//#endregion
-//#region src/user/user.ts
-function user(rest) {
-	return { getCurrentUser: () => rest.request("/user") };
-}
-//#endregion
-//#region src/workflows/workflows.ts
-function workflows(rest) {
-	return {
-		listRuns: (repo, filter) => {
-			const params = new URLSearchParams();
-			if (filter?.branch) params.set("branch", filter.branch);
-			if (filter?.limit) params.set("per_page", String(filter.limit));
-			if (filter?.status) params.set("status", filter.status);
-			const qs = params.toString();
-			const path = qs ? `${repoBase(repo)}/actions/runs?${qs}` : `${repoBase(repo)}/actions/runs`;
-			return rest.request(path).then((r) => r.workflow_runs);
-		},
-		getRun: (repo, id) => rest.request(`${repoBase(repo)}/actions/runs/${id}`),
-		/**
-		* Triggers a `workflow_dispatch` run. `workflowFile` is the workflow's
-		* filename (e.g. `"platform.dispatchedCheck.yml"`) — GitHub accepts the
-		* filename directly, no numeric workflow ID lookup needed. Fire-and-forget:
-		* the API returns `204` with no run ID, so callers needing to correlate
-		* the resulting run back to this call must pass their own correlation
-		* value through `inputs` (visible in the Actions UI/logs — never a secret).
-		*/
-		createWorkflowDispatch: (repo, workflowFile, ref, inputs) => rest.request(`${repoBase(repo)}/actions/workflows/${workflowFile}/dispatches`, {
-			method: "POST",
-			body: {
-				ref,
-				inputs
-			},
-			expectNoContent: true
-		})
-	};
-}
-//#endregion
-//#region src/app-auth/pem.ts
-/**
-* PEM/DER handling for GitHub App private keys — Web Crypto only (no
-* `node:crypto`), so this runs unchanged on Cloudflare Workers (no
-* `nodejs_compat` needed) and in Node.
-*
-* GitHub hands out App private keys in PKCS#1 ("-----BEGIN RSA PRIVATE
-* KEY-----") by default; `SubtleCrypto.importKey("pkcs8", …)` only
-* accepts PKCS#8 ("-----BEGIN PRIVATE KEY-----"). `pkcs1ToPkcs8` wraps a
-* PKCS#1 `RSAPrivateKey` DER in the fixed `PrivateKeyInfo` DER structure
-* PKCS#8 requires — a fixed `AlgorithmIdentifier` prefix for
-* `rsaEncryption` (OID 1.2.840.113549.1.1.1) around the unchanged
-* PKCS#1 bytes. Verified against a real generated key pair: imported,
-* signed, and checked against `node:crypto`'s `verify()` on the
-* original key's public half.
-*/
-function pemToDer(pem) {
-	const base64 = pem.replace(/-----BEGIN [^-]+-----/, "").replace(/-----END [^-]+-----/, "").replace(/\s/g, "");
-	return Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
-}
-function concat(...arrays) {
-	const total = arrays.reduce((sum, a) => sum + a.length, 0);
-	const out = new Uint8Array(total);
-	let offset = 0;
-	for (const a of arrays) {
-		out.set(a, offset);
-		offset += a.length;
-	}
-	return out;
-}
-function encodeDerLength(len) {
-	/* istanbul ignore next -- see comment above */
-	if (len < 128) return new Uint8Array([len]);
-	const bytes = [];
-	let n = len;
-	while (n > 0) {
-		bytes.unshift(n & 255);
-		n >>= 8;
-	}
-	return new Uint8Array([128 | bytes.length, ...bytes]);
-}
-function derEncode(tag, content) {
-	return concat(new Uint8Array([tag]), encodeDerLength(content.length), content);
-}
-/** SEQUENCE { OID rsaEncryption, NULL } — the fixed PKCS#8 AlgorithmIdentifier for RSA. */
-const RSA_ALGORITHM_IDENTIFIER = new Uint8Array([
-	48,
-	13,
-	6,
-	9,
-	42,
-	134,
-	72,
-	134,
-	247,
-	13,
-	1,
-	1,
-	1,
-	5,
-	0
-]);
-function pkcs1ToPkcs8(pkcs1) {
-	const version = new Uint8Array([
-		2,
-		1,
-		0
-	]);
-	const octetString = derEncode(4, pkcs1);
-	return derEncode(48, concat(version, RSA_ALGORITHM_IDENTIFIER, octetString));
-}
-/** Imports a PEM-encoded RSA private key — PKCS#1 or PKCS#8, either works — for RS256 signing. */
-async function importRsaPrivateKey(pem) {
-	const der = pemToDer(pem);
-	const pkcs8Der = (pem.includes("BEGIN RSA PRIVATE KEY") ? pkcs1ToPkcs8(der) : der).slice();
-	return crypto.subtle.importKey("pkcs8", pkcs8Der, {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-}
-/** Base64url (no padding) — the encoding both JWT segments and the signature use. */
-function base64UrlEncode(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-//#endregion
-//#region src/app-auth/app-auth.ts
-/**
-* GitHub App authentication — a signed App JWT, exchanged for a
-* short-lived installation access token, exchanged for a ready-to-use
-* `GitHubClient`. Web Crypto only (see `pem.ts`), so this runs unchanged
-* on Cloudflare Workers and in Node — no vendor-specific JWT library, no
-* `nodejs_compat` flag.
-*
-* https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app
-* https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation
-*/
-const CLOCK_DRIFT_BUFFER_SECONDS = 60;
-/** GitHub rejects an App JWT with more than 10 minutes between iat and exp. */
-const JWT_LIFETIME_SECONDS = 600;
-/**
-* Signs a JWT identifying this App (not a specific installation) — the
-* credential used only to request an installation access token, never
-* to call the REST API directly.
-*/
-async function createAppJWT(creds, now = Date.now()) {
-	const key = await importRsaPrivateKey(creds.privateKey);
-	const iat = Math.floor(now / 1e3) - CLOCK_DRIFT_BUFFER_SECONDS;
-	const exp = iat + JWT_LIFETIME_SECONDS;
-	const signingInput = `${base64UrlEncode(new TextEncoder().encode(JSON.stringify({
-		alg: "RS256",
-		typ: "JWT"
-	})))}.${base64UrlEncode(new TextEncoder().encode(JSON.stringify({
-		iat,
-		exp,
-		iss: creds.appId
-	})))}`;
-	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(signingInput));
-	return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
-}
-/**
-* Exchanges an App JWT for an installation access token — the credential
-* that actually authenticates REST calls, scoped to exactly one
-* installation (D10: never a hardcoded org — the caller supplies which
-* installation, from the webhook payload that triggered this).
-*/
-async function getInstallationAccessToken(creds, installationId, opts = {}) {
-	const jwt = await createAppJWT(creds);
-	const baseUrl = opts.baseUrl ?? "https://api.github.com";
-	const res = await (opts.fetch ?? globalThis.fetch)(`${baseUrl}/app/installations/${installationId}/access_tokens`, {
-		method: "POST",
-		headers: {
-			authorization: `Bearer ${jwt}`,
-			accept: "application/vnd.github+json",
-			"x-github-api-version": "2022-11-28"
-		}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new ProviderApiError(`GitHub POST /app/installations/${installationId}/access_tokens → ${res.status}`, res.status, body);
-	}
-	const json = await res.json();
-	return {
-		token: json.token,
-		expiresAt: json.expires_at
-	};
-}
-/** The whole flow in one call — an already-authenticated `GitHubClient` scoped to one installation. */
-async function createInstallationClient(creds, installationId, opts = {}) {
-	const { token } = await getInstallationAccessToken(creds, installationId, opts);
-	return createGitHubClient({
-		token,
-		baseUrl: opts.baseUrl,
-		fetch: opts.fetch
-	});
-}
-//#endregion
-//#region src/webhooks/webhooks.ts
-/**
-* GitHub's own webhook mechanics — signature verification and header/
-* payload shapes. Pure functions, no REST call, no auth token: these
-* operate on an *inbound* delivery, the mirror of everything else this
-* package does (outbound REST calls), so they're standalone exports
-* rather than part of `createGitHubClient()`'s returned object.
-*
-* A consumer (a GitHub App receiving webhooks) owns what to *do* with a
-* verified delivery — which event categories matter, how to normalize
-* them — the same split `holocron-plugin-clerk`'s `parseWebhook` draws
-* between Svix verification and Clerk-specific `AuthEvent` normalization,
-* just with the verification half living here instead of inline, since
-* "how GitHub signs and shapes a webhook" is vendor knowledge this
-* package already owns for every other GitHub API surface.
-*/
-/**
-* Verifies a GitHub webhook delivery's `X-Hub-Signature-256` header —
-* HMAC-SHA256 over the raw body, keyed by the webhook's configured
-* secret, `timingSafeEqual`-compared.
-* https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
-*
-* Returns `false` (never throws) for any failure to verify — a missing/
-* empty secret, a missing/malformed signature header, or a mismatch —
-* so the caller decides how to surface that (e.g. as its own error type).
-*/
-function verifyGitHubWebhookSignature(input) {
-	if (!input.secret || !input.signature || !input.signature.startsWith("sha256=")) return false;
-	const bodyStr = typeof input.body === "string" ? input.body : input.body.toString("utf8");
-	const provided = Buffer.from(input.signature.slice(7), "hex");
-	const computed = createHmac("sha256", input.secret).update(bodyStr).digest();
-	return provided.length === computed.length && timingSafeEqual(provided, computed);
-}
-/** Extracts GitHub's three webhook headers, case-insensitively (Node's raw headers may arrive lower-cased, or as an array when a header repeats). */
-function parseGitHubWebhookHeaders(headers) {
-	const find = (name) => {
-		const target = name.toLowerCase();
-		for (const [k, v] of Object.entries(headers)) if (k.toLowerCase() === target) return Array.isArray(v) ? v[0] : v;
-	};
-	return {
-		event: find("x-github-event"),
-		delivery: find("x-github-delivery"),
-		signature: find("x-hub-signature-256")
-	};
-}
-//#endregion
-//#region src/index.ts
-function createGitHubClient(opts) {
-	const rest = createGitHubRestClient(opts);
-	return {
-		branches: branches(rest),
-		checks: checks(rest),
-		environments: environments(rest),
-		git: git(rest),
-		issues: issues(rest),
-		labels: labels(rest),
-		pages: pages(rest),
-		properties: properties(rest),
-		pulls: pulls(rest),
-		repos: repos(rest),
-		rulesets: rulesets(rest),
-		secrets: secrets(rest),
-		security: security(rest),
-		teams: teams(rest),
-		topics: topics(rest),
-		user: user(rest),
-		workflows: workflows(rest)
-	};
-}
-//#endregion
-export { createAppJWT, createGitHubClient, createInstallationClient, getInstallationAccessToken, parseGitHubWebhookHeaders, verifyGitHubWebhookSignature };