@theholocron/github-client 1.32.0 → 1.33.0

package/dist/index.d.mts

@@ -0,0 +1,570 @@
+import "@theholocron/http-client";
+import { ErrorSink, Logger } from "@theholocron/observability/core";
+//#region ../../../../../src/utils.d.ts
+interface GitHubClientOptions {
+  token: string;
+  baseUrl?: string;
+  fetch?: typeof fetch;
+  /** Structured logger for request/response diagnostics. Defaults to a no-op. */
+  logger?: Logger;
+  /** Reports transport failures and unexpected 5xx. Defaults to a no-op. */
+  errors?: ErrorSink;
+}
+//#endregion
+//#region ../../../../../src/checks/checks.d.ts
+type CheckRunStatus = "queued" | "in_progress" | "completed";
+type CheckRunConclusion = "success" | "failure" | "neutral" | "cancelled" | "timed_out" | "action_required" | "skipped";
+type CheckRunAnnotationLevel = "notice" | "warning" | "failure";
+interface CheckRunAnnotation {
+  /** File path relative to the repo root. */
+  path: string;
+  /** 1-indexed. */
+  start_line: number;
+  end_line: number;
+  /** Only valid when `start_line === end_line`. */
+  start_column?: number;
+  end_column?: number;
+  annotation_level: CheckRunAnnotationLevel;
+  /** Max 64KB. */
+  message: string;
+  /** Max 255 characters. */
+  title?: string;
+  /** Max 64KB. */
+  raw_details?: string;
+}
+interface CheckRunOutput {
+  title: string;
+  summary: string;
+  text?: string;
+  /**
+   * Inline PR annotations — up to 50 per request. Sending more requires a
+   * follow-up `updateCheckRun()` PATCH per GitHub's own docs; this client
+   * doesn't paginate them for you.
+   */
+  annotations?: CheckRunAnnotation[];
+}
+interface CreateCheckRunInput {
+  name: string;
+  /** The commit SHA the check run attaches to. */
+  head_sha: string;
+  /** Defaults to `"queued"` (GitHub's own default) when omitted. */
+  status?: CheckRunStatus;
+  /** Required when `status` is `"completed"`. */
+  conclusion?: CheckRunConclusion;
+  output?: CheckRunOutput;
+  /** URL for the "Details" link on the check run. GitHub defaults to the check suite's own summary page when omitted. */
+  details_url?: string;
+}
+interface GitHubCheckRun {
+  id: number;
+  name: string;
+  head_sha: string;
+  status: CheckRunStatus;
+  conclusion: CheckRunConclusion | null;
+  html_url: string;
+}
+interface UpdateCheckRunInput {
+  status?: CheckRunStatus;
+  /** Required when `status` is `"completed"`. */
+  conclusion?: CheckRunConclusion;
+  output?: CheckRunOutput;
+  /** URL for the "Details" link on the check run. */
+  details_url?: string;
+}
+//#endregion
+//#region ../../../../../src/environments/environments.d.ts
+interface GitHubEnvironment {
+  name: string;
+  wait_timer?: number;
+  prevent_self_review?: boolean;
+  protection_rules?: Array<{
+    type: string;
+    reviewers?: Array<{
+      type: "User" | "Team";
+      reviewer: {
+        id: number;
+      };
+    }>;
+  }>;
+}
+//#endregion
+//#region ../../../../../src/git/git.d.ts
+interface GitRef {
+  object: {
+    sha: string;
+    type: string;
+    url: string;
+  };
+  ref: string;
+  url: string;
+}
+interface GitCommit {
+  sha: string;
+  tree: {
+    sha: string;
+    url: string;
+  };
+}
+interface GitTreeItem {
+  path: string;
+  sha: string;
+  type: string;
+  mode?: string;
+  size?: number;
+}
+interface GitTree {
+  sha: string;
+  tree: GitTreeItem[];
+  truncated: boolean;
+}
+interface GitContents {
+  content: string;
+  encoding: string;
+  sha: string;
+  name: string;
+  path: string;
+}
+interface GitBlob {
+  sha: string;
+  url: string;
+}
+interface GitPull {
+  number: number;
+  html_url: string;
+  title: string;
+}
+interface CreatePullInput {
+  title: string;
+  head: string;
+  base: string;
+  body?: string;
+}
+//#endregion
+//#region ../../../../../src/issues/issues.d.ts
+interface GitHubIssue {
+  id: number;
+  number: number;
+  title: string;
+  body?: string | null;
+  state: "open" | "closed";
+  labels: Array<{
+    name: string;
+  }>;
+  assignee: {
+    login: string;
+    name?: string | null;
+    email?: string | null;
+  } | null;
+  updated_at: string;
+  html_url: string;
+  pull_request?: unknown;
+}
+interface GitHubMilestone {
+  number: number;
+  title: string;
+}
+interface IssueSearchParams {
+  state?: "open" | "closed" | "all";
+  sort?: string;
+  direction?: string;
+  per_page?: number;
+  filter?: string;
+  assignee?: string;
+}
+//#endregion
+//#region ../../../../../src/labels/labels.d.ts
+interface GitHubLabel {
+  name: string;
+  color: string;
+  description: string | null;
+}
+//#endregion
+//#region ../../../../../src/pages/pages.d.ts
+type PagesBuildType = "workflow" | "legacy";
+type PagesBuildStatus = "built" | "building" | "errored" | "unknown";
+interface GitHubPages {
+  status: PagesBuildStatus | null;
+  build_type: PagesBuildType | null;
+  source?: {
+    branch: string;
+    path: string;
+  };
+  https_enforced: boolean;
+  custom_domain: string | null;
+}
+interface CreatePagesPayload {
+  build_type: PagesBuildType;
+  /** Required when build_type is "legacy". */
+  source?: {
+    branch: string;
+    path: string;
+  };
+}
+interface UpdatePagesPayload {
+  build_type?: PagesBuildType;
+  source?: {
+    branch: string;
+    path: string;
+  };
+  cname?: string | null;
+  https_enforced?: boolean;
+}
+//#endregion
+//#region ../../../../../src/pulls/pulls.d.ts
+interface GitHubPullRequest {
+  number: number;
+  title: string;
+  state: "open" | "closed";
+  merged_at: string | null;
+  html_url: string;
+  head: {
+    ref: string;
+  };
+}
+/** One commit as returned by `GET /pulls/{pull_number}/commits` — only the fields any known consumer needs. */
+interface GitHubPullRequestCommit {
+  sha: string;
+  commit: {
+    message: string;
+  };
+}
+/** One file as returned by `GET /pulls/{pull_number}/files` — only the fields any known consumer needs. */
+interface GitHubPullRequestFile {
+  filename: string;
+  status: "added" | "removed" | "modified" | "renamed" | "copied" | "changed" | "unchanged";
+  /** Set only when `status === "renamed"`. */
+  previous_filename?: string;
+}
+/** One inline comment in a `POST /pulls/{pull_number}/reviews` request body. */
+interface CreateReviewComment {
+  /** File path relative to the repo root. */
+  path: string;
+  /** 1-indexed line in the file's current (`RIGHT`) version — GitHub anchors a review comment to a line, not a column. */
+  line: number;
+  /** Almost always `"RIGHT"` (the PR's own new content) — `"LEFT"` targets the base/pre-PR version instead. */
+  side: "LEFT" | "RIGHT";
+  body: string;
+}
+interface CreateReviewInput {
+  /** The PR's head SHA the review attaches to. */
+  commit_id: string;
+  /** The review's own top-level summary, shown above its inline comments. */
+  body: string;
+  /**
+   * `"COMMENT"` never blocks a merge by itself — the right choice for an
+   * advisory bot review. `"REQUEST_CHANGES"`/`"APPROVE"` carry the same
+   * real weight as a human reviewer's own review state, affecting
+   * required-approval counts and dismissal.
+   */
+  event: "COMMENT" | "REQUEST_CHANGES" | "APPROVE";
+  comments?: CreateReviewComment[];
+}
+/** `POST /pulls/{pull_number}/reviews`'s response — only the fields any known consumer needs. */
+interface GitHubPullRequestReview {
+  id: number;
+  html_url: string;
+}
+/**
+ * One review thread — GraphQL-only (`resolveReviewThread`, the mutation
+ * this exists to support, has no REST equivalent at all). `id` here is a
+ * GraphQL node ID (`PRRT_...`), not the same numeric ID space as REST's
+ * review-comment `id` — pass it straight through to `resolveReviewThread()`,
+ * never compare it against a REST-sourced ID.
+ */
+interface ReviewThread {
+  id: string;
+  isResolved: boolean;
+  /** The thread's first comment's author login (e.g. `"the-holocron-sentinel[bot]"`) — `undefined` if GitHub ever returns a thread with no comments, which shouldn't happen in practice. Callers filter on this before resolving anything, so a bot never touches a human reviewer's own thread. */
+  authorLogin: string | undefined;
+  /** The file the thread is anchored to on the PR's current diff — `null` once GitHub can no longer place it there (e.g. the file was since deleted). */
+  path: string | null;
+  /** 1-indexed line the thread is anchored to — `null` in the same "can no longer place it" case as `path`. */
+  line: number | null;
+  /**
+   * The thread's first comment's own body — the exact text a caller like
+   * Sentinel posted for a specific finding. Lets a caller diff a prior
+   * thread's own content against the current push's findings (holocron#860)
+   * to decide whether that finding is still live, rather than only knowing
+   * a thread exists. `undefined` in the same no-comments case as
+   * `authorLogin`.
+   */
+  body: string | undefined;
+}
+//#endregion
+//#region ../../../../../src/repos/repos.d.ts
+interface GitHubRepo {
+  default_branch: string;
+  full_name: string;
+}
+interface GitHubContents {
+  content: string;
+  encoding: string;
+}
+//#endregion
+//#region ../../../../../src/rulesets/rulesets.d.ts
+interface GitHubRuleset {
+  id: number;
+  name: string;
+  enforcement: string;
+}
+//#endregion
+//#region ../../../../../src/secrets/secrets.d.ts
+type SecretScope = {
+  kind: "repo";
+} | {
+  kind: "environment";
+  name: string;
+} | {
+  kind: "organization";
+  org: string;
+};
+interface GitHubPublicKey {
+  key_id: string;
+  key: string;
+}
+//#endregion
+//#region ../../../../../src/security/security.d.ts
+interface CodeScanningSetupResult {
+  run_id: number;
+  run_url: string;
+}
+//#endregion
+//#region ../../../../../src/teams/teams.d.ts
+type TeamPermission = "pull" | "triage" | "push" | "maintain" | "admin";
+//#endregion
+//#region ../../../../../src/user/user.d.ts
+interface GitHubUser {
+  login: string;
+  name: string | null;
+  email: string | null;
+}
+//#endregion
+//#region ../../../../../src/workflows/workflows.d.ts
+interface GitHubWorkflowRun {
+  id: number;
+  name: string | null;
+  display_title: string;
+  head_branch: string;
+  head_sha: string;
+  status: string;
+  conclusion: string | null;
+  html_url: string;
+  created_at: string;
+  updated_at: string;
+}
+interface WorkflowRunFilter {
+  branch?: string;
+  limit?: number;
+  status?: string;
+}
+//#endregion
+//#region ../../../../../src/app-auth/app-auth.d.ts
+interface GitHubAppCredentials {
+  /** The App's numeric id (not the client id). */
+  appId: string;
+  /** PEM-encoded RSA private key — PKCS#1 (GitHub's default download format) or PKCS#8, either works. */
+  privateKey: string;
+}
+interface InstallationAccessToken {
+  token: string;
+  /** ISO 8601 — installation tokens are short-lived, about an hour. */
+  expiresAt: string;
+}
+/**
+ * Signs a JWT identifying this App (not a specific installation) — the
+ * credential used only to request an installation access token, never
+ * to call the REST API directly.
+ */
+declare function createAppJWT(creds: GitHubAppCredentials, now?: number): Promise<string>;
+/**
+ * Exchanges an App JWT for an installation access token — the credential
+ * that actually authenticates REST calls, scoped to exactly one
+ * installation (D10: never a hardcoded org — the caller supplies which
+ * installation, from the webhook payload that triggered this).
+ */
+declare function getInstallationAccessToken(creds: GitHubAppCredentials, installationId: number, opts?: Pick<GitHubClientOptions, "baseUrl" | "fetch">): Promise<InstallationAccessToken>;
+/** The whole flow in one call — an already-authenticated `GitHubClient` scoped to one installation. */
+declare function createInstallationClient(creds: GitHubAppCredentials, installationId: number, opts?: Pick<GitHubClientOptions, "baseUrl" | "fetch">): Promise<GitHubClient>;
+//#endregion
+//#region ../../../../../src/webhooks/webhooks.d.ts
+/**
+ * GitHub's own webhook mechanics — signature verification and header/
+ * payload shapes. Pure functions, no REST call, no auth token: these
+ * operate on an *inbound* delivery, the mirror of everything else this
+ * package does (outbound REST calls), so they're standalone exports
+ * rather than part of `createGitHubClient()`'s returned object.
+ *
+ * A consumer (a GitHub App receiving webhooks) owns what to *do* with a
+ * verified delivery — which event categories matter, how to normalize
+ * them — the same split `holocron-plugin-clerk`'s `parseWebhook` draws
+ * between Svix verification and Clerk-specific `AuthEvent` normalization,
+ * just with the verification half living here instead of inline, since
+ * "how GitHub signs and shapes a webhook" is vendor knowledge this
+ * package already owns for every other GitHub API surface.
+ */
+/**
+ * Verifies a GitHub webhook delivery's `X-Hub-Signature-256` header —
+ * HMAC-SHA256 over the raw body, keyed by the webhook's configured
+ * secret, `timingSafeEqual`-compared.
+ * https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
+ *
+ * Returns `false` (never throws) for any failure to verify — a missing/
+ * empty secret, a missing/malformed signature header, or a mismatch —
+ * so the caller decides how to surface that (e.g. as its own error type).
+ */
+declare function verifyGitHubWebhookSignature(input: {
+  body: string | Buffer;
+  signature: string | undefined;
+  secret: string;
+}): boolean;
+interface GitHubWebhookHeaders {
+  /** `X-GitHub-Event` — the event category, e.g. `"push"`, `"pull_request"`. */
+  event: string | undefined;
+  /** `X-GitHub-Delivery` — GitHub's per-delivery id, useful for idempotency/logging. */
+  delivery: string | undefined;
+  /** `X-Hub-Signature-256` — pass straight to `verifyGitHubWebhookSignature`. */
+  signature: string | undefined;
+}
+/** Extracts GitHub's three webhook headers, case-insensitively (Node's raw headers may arrive lower-cased, or as an array when a header repeats). */
+declare function parseGitHubWebhookHeaders(headers: Record<string, string | string[] | undefined>): GitHubWebhookHeaders;
+interface GitHubInstallationWebhookPayload {
+  action: string;
+  installation: {
+    id: number;
+  };
+}
+interface GitHubPushWebhookPayload {
+  ref: string;
+  installation?: {
+    id: number;
+  };
+  repository: {
+    full_name: string;
+    default_branch: string;
+  };
+}
+interface GitHubPullRequestWebhookPayload {
+  action: string;
+  installation?: {
+    id: number;
+  };
+  repository: {
+    full_name: string;
+  };
+}
+//#endregion
+//#region ../../../../../src/index.d.ts
+declare function createGitHubClient(opts: GitHubClientOptions): {
+  branches: {
+    protectBranch: (repo: string, branch: string, payload: Record<string, unknown>) => Promise<void>;
+  };
+  checks: {
+    createCheckRun: (repo: string, input: CreateCheckRunInput) => Promise<GitHubCheckRun>;
+    updateCheckRun: (repo: string, checkRunId: number, input: UpdateCheckRunInput) => Promise<GitHubCheckRun>;
+  };
+  environments: {
+    listEnvironments: (repo: string) => Promise<GitHubEnvironment[]>;
+    upsertEnvironment: (repo: string, name: string, body: Record<string, unknown>) => Promise<void>;
+    deleteEnvironment: (repo: string, name: string) => Promise<void>;
+  };
+  git: {
+    getRef: (repo: string, branch: string) => Promise<GitRef>;
+    getCommit: (repo: string, sha: string) => Promise<GitCommit>;
+    getTree: (repo: string, sha: string, recursive?: boolean) => Promise<GitTree>;
+    getContents: (repo: string, path: string, ref?: string) => Promise<GitContents>;
+    createBlob: (repo: string, content: string, encoding?: string) => Promise<GitBlob>;
+    createTree: (repo: string, tree: Array<{
+      path: string;
+      mode: string;
+      type: string;
+      sha: string;
+    }>, baseTree?: string) => Promise<GitTree>;
+    createCommit: (repo: string, message: string, tree: string, parents: string[]) => Promise<GitCommit>;
+    createRef: (repo: string, ref: string, sha: string) => Promise<GitRef>;
+    updateRef: (repo: string, ref: string, sha: string, force?: boolean) => Promise<GitRef>;
+    createPull: (repo: string, input: CreatePullInput) => Promise<GitPull>;
+  };
+  issues: {
+    listIssues: (repo: string, params?: IssueSearchParams) => Promise<GitHubIssue[]>;
+    getIssue: (repo: string, number: number) => Promise<GitHubIssue>;
+    createIssue: (repo: string, body: Record<string, unknown>) => Promise<GitHubIssue>;
+    updateIssue: (repo: string, number: number, body: Record<string, unknown>) => Promise<GitHubIssue>;
+    addLabels: (repo: string, number: number, labels: string[]) => Promise<void>;
+    removeLabel: (repo: string, number: number, label: string) => Promise<void>;
+    createComment: (repo: string, number: number, body: string) => Promise<void>;
+    listMilestones: (repo: string, params?: {
+      state?: "open" | "closed" | "all";
+    }) => Promise<GitHubMilestone[]>;
+  };
+  labels: {
+    listLabels: (repo: string) => Promise<GitHubLabel[]>;
+    createLabel: (repo: string, body: {
+      name: string;
+      color: string;
+      description: string;
+    }) => Promise<GitHubLabel>;
+    updateLabel: (repo: string, name: string, body: {
+      color?: string;
+      description?: string;
+    }) => Promise<GitHubLabel>;
+    deleteLabel: (repo: string, name: string) => Promise<void>;
+  };
+  pages: {
+    getPages: (repo: string) => Promise<GitHubPages | null>;
+    createPages: (repo: string, payload: CreatePagesPayload) => Promise<GitHubPages>;
+    updatePages: (repo: string, payload: UpdatePagesPayload) => Promise<void>;
+  };
+  properties: {
+    setProperties: (repo: string, values: Record<string, string | string[]>) => Promise<void>;
+  };
+  pulls: {
+    getPullRequest: (repo: string, number: number) => Promise<GitHubPullRequest>;
+    listCommits: (repo: string, number: number) => Promise<GitHubPullRequestCommit[]>;
+    listFiles: (repo: string, number: number) => Promise<GitHubPullRequestFile[]>;
+    createReview: (repo: string, number: number, input: CreateReviewInput) => Promise<GitHubPullRequestReview>;
+    listReviewThreads: (repo: string, number: number) => Promise<ReviewThread[]>;
+    resolveReviewThread: (threadId: string) => Promise<void>;
+  };
+  repos: {
+    getRepo: (repo: string) => Promise<GitHubRepo>;
+    updateRepo: (repo: string, settings: Record<string, unknown>) => Promise<void>;
+    getContents: (repo: string, path: string) => Promise<GitHubContents>;
+  };
+  rulesets: {
+    listRulesets: (repo: string) => Promise<GitHubRuleset[]>;
+    createRuleset: (repo: string, payload: Record<string, unknown>) => Promise<GitHubRuleset>;
+    updateRuleset: (repo: string, id: number, payload: Record<string, unknown>) => Promise<GitHubRuleset>;
+  };
+  secrets: {
+    listSecrets: (repo: string, scope: SecretScope) => Promise<string[]>;
+    getPublicKey: (repo: string, scope: SecretScope) => Promise<GitHubPublicKey>;
+    putSecret: (repo: string, scope: SecretScope, name: string, body: Record<string, unknown>) => Promise<void>;
+    deleteSecret: (repo: string, scope: SecretScope, name: string) => Promise<void>;
+  };
+  security: {
+    enableVulnerabilityAlerts: (repo: string) => Promise<void>;
+    enableAutomatedSecurityFixes: (repo: string) => Promise<void>;
+    enableSecretScanning: (repo: string) => Promise<void>;
+    enablePrivateVulnerabilityReporting: (repo: string) => Promise<void>;
+    enableDependencyGraph: (repo: string) => Promise<void>;
+    enableCodeScanning: (repo: string) => Promise<CodeScanningSetupResult>;
+    disableDefaultCodeScanning: (repo: string) => Promise<void>;
+  };
+  teams: {
+    addRepo: (org: string, teamSlug: string, owner: string, repo: string, permission: TeamPermission) => Promise<void>;
+  };
+  topics: {
+    setTopics: (repo: string, names: string[]) => Promise<void>;
+  };
+  user: {
+    getCurrentUser: () => Promise<GitHubUser>;
+  };
+  workflows: {
+    listRuns: (repo: string, filter?: WorkflowRunFilter) => Promise<GitHubWorkflowRun[]>;
+    getRun: (repo: string, id: string | number) => Promise<GitHubWorkflowRun>;
+    createWorkflowDispatch: (repo: string, workflowFile: string, ref: string, inputs?: Record<string, string>) => Promise<void>;
+  };
+};
+type GitHubClient = ReturnType<typeof createGitHubClient>;
+//#endregion
+export { type CheckRunAnnotation, type CheckRunAnnotationLevel, type CheckRunConclusion, type CheckRunOutput, type CheckRunStatus, type CodeScanningSetupResult, type CreateCheckRunInput, type CreatePagesPayload, type CreatePullInput, type CreateReviewComment, type CreateReviewInput, type GitBlob, type GitCommit, type GitContents, type GitHubAppCredentials, type GitHubCheckRun, GitHubClient, type GitHubClientOptions, type GitHubContents, type GitHubEnvironment, type GitHubInstallationWebhookPayload, type GitHubIssue, type GitHubLabel, type GitHubMilestone, type GitHubPages, type GitHubPublicKey, type GitHubPullRequest, type GitHubPullRequestCommit, type GitHubPullRequestFile, type GitHubPullRequestReview, type GitHubPullRequestWebhookPayload, type GitHubPushWebhookPayload, type GitHubRepo, type GitHubRuleset, type GitHubUser, type GitHubWebhookHeaders, type GitHubWorkflowRun, type GitPull, type GitRef, type GitTree, type GitTreeItem, type InstallationAccessToken, type IssueSearchParams, type PagesBuildStatus, type PagesBuildType, type ReviewThread, type SecretScope, type TeamPermission, type UpdateCheckRunInput, type UpdatePagesPayload, type WorkflowRunFilter, createAppJWT, createGitHubClient, createInstallationClient, getInstallationAccessToken, parseGitHubWebhookHeaders, verifyGitHubWebhookSignature };

package/dist/index.mjs

@@ -0,0 +1,733 @@
+import { ProviderApiError, createRestClient } from "@theholocron/http-client";
+import { createHmac, timingSafeEqual } from "node:crypto";
+//#region ../../../../../src/graphql/graphql.ts
+function createGitHubGraphQLClient(config) {
+	const rest = createRestClient({
+		baseUrl: config.baseUrl ?? "https://api.github.com",
+		token: config.token,
+		vendor: "GitHub GraphQL",
+		fetch: config.fetch,
+		logger: config.logger,
+		errors: config.errors
+	});
+	return { async query(document, variables) {
+		const result = await rest.request("/graphql", {
+			method: "POST",
+			body: {
+				query: document,
+				variables
+			}
+		});
+		if (result.errors && result.errors.length > 0) throw new ProviderApiError(`GitHub GraphQL → ${result.errors.map((e) => e.message).join("; ")}`, 200, result.errors);
+		return result.data;
+	} };
+}
+//#endregion
+//#region ../../../../../src/utils.ts
+function createGitHubRestClient(opts) {
+	return createRestClient({
+		baseUrl: opts.baseUrl ?? "https://api.github.com",
+		token: opts.token,
+		extraHeaders: {
+			accept: "application/vnd.github+json",
+			"x-github-api-version": "2022-11-28"
+		},
+		vendor: "GitHub",
+		fetch: opts.fetch,
+		logger: opts.logger,
+		errors: opts.errors
+	});
+}
+/** GitHub's GraphQL endpoint — a distinct client from `createGitHubRestClient()`'s REST one; see `graphql/graphql.ts` for why a shared transport still needed its own response-error handling. */
+function createGitHubGraphQLApiClient(opts) {
+	return createGitHubGraphQLClient({
+		baseUrl: opts.baseUrl,
+		token: opts.token,
+		fetch: opts.fetch,
+		logger: opts.logger,
+		errors: opts.errors
+	});
+}
+/** `/repos/owner/name` prefix from a `"owner/name"` repo string. */
+function repoBase(repo) {
+	const [owner, name] = repo.split("/", 2);
+	return `/repos/${owner}/${name}`;
+}
+/** `["owner", "name"]` from a `"owner/name"` repo string — GraphQL's `repository(owner:, name:)` args take them separately, unlike REST's single path segment. */
+function splitRepo(repo) {
+	const [owner, name] = repo.split("/", 2);
+	return [owner ?? "", name ?? ""];
+}
+//#endregion
+//#region ../../../../../src/branches/branches.ts
+function branches(rest) {
+	return { protectBranch: (repo, branch, payload) => rest.request(`${repoBase(repo)}/branches/${encodeURIComponent(branch)}/protection`, {
+		method: "PUT",
+		body: payload
+	}) };
+}
+//#endregion
+//#region ../../../../../src/checks/checks.ts
+function checks(rest) {
+	return {
+		createCheckRun: (repo, input) => rest.request(`${repoBase(repo)}/check-runs`, {
+			method: "POST",
+			body: input
+		}),
+		/** Patches an existing check run — used to move a `"queued"` run posted before a dispatched task ran to `"completed"` once it finishes. */
+		updateCheckRun: (repo, checkRunId, input) => rest.request(`${repoBase(repo)}/check-runs/${checkRunId}`, {
+			method: "PATCH",
+			body: input
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/environments/environments.ts
+function environments(rest) {
+	return {
+		listEnvironments: (repo) => rest.request(`${repoBase(repo)}/environments`).then((r) => r.environments),
+		upsertEnvironment: (repo, name, body) => rest.request(`${repoBase(repo)}/environments/${encodeURIComponent(name)}`, {
+			method: "PUT",
+			body
+		}),
+		deleteEnvironment: (repo, name) => rest.request(`${repoBase(repo)}/environments/${encodeURIComponent(name)}`, {
+			method: "DELETE",
+			expectNoContent: true
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/git/git.ts
+function git(rest) {
+	return {
+		getRef: (repo, branch) => rest.request(`${repoBase(repo)}/git/ref/heads/${branch}`),
+		getCommit: (repo, sha) => rest.request(`${repoBase(repo)}/git/commits/${sha}`),
+		getTree: (repo, sha, recursive = false) => rest.request(`${repoBase(repo)}/git/trees/${sha}${recursive ? "?recursive=1" : ""}`),
+		/**
+		* `ref` defaults to the repo's default branch (GitHub's own default)
+		* when omitted — the security-relevant choice every existing caller
+		* relies on (D4/D6, `validateConfig()`'s own docstring). Pass it
+		* explicitly to read a specific commit/branch's content instead — a
+		* same-repo PR branch is no longer a new trust boundary for this org
+		* (D6-amended, `tech-sentinel-ci-runner.spec.md`), just never a fork's.
+		*/
+		getContents: (repo, path, ref) => rest.request(`${repoBase(repo)}/contents/${path}`, ref ? { query: { ref } } : void 0),
+		createBlob: (repo, content, encoding = "utf-8") => rest.request(`${repoBase(repo)}/git/blobs`, {
+			method: "POST",
+			body: {
+				content,
+				encoding
+			}
+		}),
+		createTree: (repo, tree, baseTree) => rest.request(`${repoBase(repo)}/git/trees`, {
+			method: "POST",
+			body: {
+				base_tree: baseTree,
+				tree
+			}
+		}),
+		createCommit: (repo, message, tree, parents) => rest.request(`${repoBase(repo)}/git/commits`, {
+			method: "POST",
+			body: {
+				message,
+				tree,
+				parents
+			}
+		}),
+		createRef: (repo, ref, sha) => rest.request(`${repoBase(repo)}/git/refs`, {
+			method: "POST",
+			body: {
+				ref,
+				sha
+			}
+		}),
+		updateRef: (repo, ref, sha, force = false) => rest.request(`${repoBase(repo)}/git/refs/${ref}`, {
+			method: "PATCH",
+			body: {
+				sha,
+				force
+			}
+		}),
+		createPull: (repo, input) => rest.request(`${repoBase(repo)}/pulls`, {
+			method: "POST",
+			body: input
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/issues/issues.ts
+function issues(rest) {
+	return {
+		listIssues: (repo, params = {}) => {
+			const qs = new URLSearchParams();
+			if (params.state) qs.set("state", params.state);
+			if (params.sort) qs.set("sort", params.sort);
+			if (params.direction) qs.set("direction", params.direction);
+			if (params.per_page) qs.set("per_page", String(params.per_page));
+			if (params.filter) qs.set("filter", params.filter);
+			if (params.assignee) qs.set("assignee", params.assignee);
+			const q = qs.toString();
+			const path = q ? `${repoBase(repo)}/issues?${q}` : `${repoBase(repo)}/issues`;
+			return rest.request(path);
+		},
+		getIssue: (repo, number) => rest.request(`${repoBase(repo)}/issues/${number}`),
+		createIssue: (repo, body) => rest.request(`${repoBase(repo)}/issues`, {
+			method: "POST",
+			body
+		}),
+		updateIssue: (repo, number, body) => rest.request(`${repoBase(repo)}/issues/${number}`, {
+			method: "PATCH",
+			body
+		}),
+		addLabels: (repo, number, labels) => rest.request(`${repoBase(repo)}/issues/${number}/labels`, {
+			method: "POST",
+			body: { labels }
+		}),
+		removeLabel: (repo, number, label) => rest.request(`${repoBase(repo)}/issues/${number}/labels/${encodeURIComponent(label)}`, { method: "DELETE" }),
+		createComment: (repo, number, body) => rest.request(`${repoBase(repo)}/issues/${number}/comments`, {
+			method: "POST",
+			body: { body }
+		}),
+		listMilestones: (repo, params = {}) => {
+			const qs = new URLSearchParams({ per_page: "100" });
+			if (params.state) qs.set("state", params.state);
+			return rest.request(`${repoBase(repo)}/milestones?${qs.toString()}`);
+		}
+	};
+}
+//#endregion
+//#region ../../../../../src/labels/labels.ts
+function labels(rest) {
+	return {
+		listLabels: (repo) => rest.request(`${repoBase(repo)}/labels?per_page=100`),
+		createLabel: (repo, body) => rest.request(`${repoBase(repo)}/labels`, {
+			method: "POST",
+			body
+		}),
+		updateLabel: (repo, name, body) => rest.request(`${repoBase(repo)}/labels/${encodeURIComponent(name)}`, {
+			method: "PATCH",
+			body
+		}),
+		deleteLabel: (repo, name) => rest.request(`${repoBase(repo)}/labels/${encodeURIComponent(name)}`, { method: "DELETE" })
+	};
+}
+//#endregion
+//#region ../../../../../src/pages/pages.ts
+function pages(rest) {
+	return {
+		/** Returns null when Pages is not yet enabled (404). */
+		getPages: async (repo) => {
+			try {
+				return await rest.request(`${repoBase(repo)}/pages`);
+			} catch (err) {
+				if (err instanceof ProviderApiError && err.status === 404) return null;
+				throw err;
+			}
+		},
+		/**
+		* Enables Pages for the first time.
+		* Throws on all errors except 409 Conflict (already enabled — callers
+		* should catch that and fall through to updatePages).
+		*/
+		createPages: (repo, payload) => rest.request(`${repoBase(repo)}/pages`, {
+			method: "POST",
+			body: payload
+		}),
+		/**
+		* Updates Pages settings on an existing site (build type, cname, https).
+		* GitHub returns 204 No Content.
+		*/
+		updatePages: (repo, payload) => rest.request(`${repoBase(repo)}/pages`, {
+			method: "PUT",
+			body: payload
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/properties/properties.ts
+function properties(rest) {
+	return { 
+	/**
+	* `value` is a plain string for `string`/`single_select`/`true_false`
+	* custom properties, or a string array for `multi_select` ones —
+	* GitHub's own PATCH body accepts either per property. A single-string
+	* comma-joined value has no length ceiling GitHub documents, but real
+	* usage hits one in practice (a `string`-type property with enough
+	* joined values 422s as "too long"); `multi_select` has none.
+	*/
+setProperties: (repo, values) => {
+		const propertyList = Object.entries(values).map(([property_name, value]) => ({
+			property_name,
+			value
+		}));
+		return rest.request(`${repoBase(repo)}/properties/values`, {
+			method: "PATCH",
+			body: { properties: propertyList }
+		});
+	} };
+}
+//#endregion
+//#region ../../../../../src/pulls/pulls.ts
+const LIST_REVIEW_THREADS_QUERY = `
+	query($owner: String!, $name: String!, $number: Int!) {
+		repository(owner: $owner, name: $name) {
+			pullRequest(number: $number) {
+				reviewThreads(first: 100) {
+					nodes {
+						id
+						isResolved
+						path
+						line
+						comments(first: 1) {
+							nodes {
+								author { login }
+								body
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+`;
+const RESOLVE_REVIEW_THREAD_MUTATION = `
+	mutation($threadId: ID!) {
+		resolveReviewThread(input: { threadId: $threadId }) {
+			thread { id isResolved }
+		}
+	}
+`;
+function pulls(rest, graphql) {
+	return {
+		getPullRequest: (repo, number) => rest.request(`${repoBase(repo)}/pulls/${number}`),
+		/**
+		* A PR's own commits, in commit order. `per_page=100` — GitHub's max —
+		* covers every real PR in this org; a PR genuinely exceeding 100
+		* commits (GitHub caps this endpoint at 250 regardless of pagination)
+		* is an edge case no consumer here needs to paginate for today.
+		*/
+		listCommits: (repo, number) => rest.request(`${repoBase(repo)}/pulls/${number}/commits?per_page=100`),
+		/**
+		* A PR's own changed files. `per_page=100` — GitHub's max — covers
+		* every real PR in this org; a PR genuinely exceeding 100 changed
+		* files (GitHub caps this endpoint at 3000 regardless of pagination)
+		* is an edge case no consumer here needs to paginate for today.
+		*/
+		listFiles: (repo, number) => rest.request(`${repoBase(repo)}/pulls/${number}/files?per_page=100`),
+		/**
+		* Submits a review in one call — GitHub has no separate "create draft,
+		* then submit" step when `event` is provided directly (the multi-step
+		* `PENDING` review flow exists for the web UI's own draft-comments
+		* experience, not needed here).
+		*/
+		createReview: (repo, number, input) => rest.request(`${repoBase(repo)}/pulls/${number}/reviews`, {
+			method: "POST",
+			body: input
+		}),
+		/** Every review thread on a PR, resolved or not — GraphQL-only, `first: 100` covers every real PR's review-thread count in this org today; no consumer needs pagination yet. */
+		listReviewThreads: async (repo, number) => {
+			const [owner, name] = splitRepo(repo);
+			return (await graphql.query(LIST_REVIEW_THREADS_QUERY, {
+				owner,
+				name,
+				number
+			})).repository.pullRequest.reviewThreads.nodes.map((node) => ({
+				id: node.id,
+				isResolved: node.isResolved,
+				path: node.path,
+				line: node.line,
+				authorLogin: node.comments.nodes[0]?.author?.login,
+				body: node.comments.nodes[0]?.body
+			}));
+		},
+		/**
+		* Marks one review thread resolved. Requires `Contents: Write` —
+		* confirmed directly against GitHub's own behavior (surprising, since
+		* resolving a thread creates no commit, touches no file, moves no
+		* ref — it only toggles a boolean on PR conversation metadata), not
+		* `Pull requests: Write` the way `createReview()` needs.
+		*/
+		resolveReviewThread: (threadId) => graphql.query(RESOLVE_REVIEW_THREAD_MUTATION, { threadId })
+	};
+}
+//#endregion
+//#region ../../../../../src/repos/repos.ts
+function repos(rest) {
+	return {
+		getRepo: (repo) => rest.request(repoBase(repo)),
+		updateRepo: (repo, settings) => rest.request(repoBase(repo), {
+			method: "PATCH",
+			body: settings
+		}),
+		getContents: (repo, path) => rest.request(`${repoBase(repo)}/contents/${path}`)
+	};
+}
+//#endregion
+//#region ../../../../../src/rulesets/rulesets.ts
+function rulesets(rest) {
+	return {
+		listRulesets: (repo) => rest.request(`${repoBase(repo)}/rulesets`),
+		createRuleset: (repo, payload) => rest.request(`${repoBase(repo)}/rulesets`, {
+			method: "POST",
+			body: payload
+		}),
+		updateRuleset: (repo, id, payload) => rest.request(`${repoBase(repo)}/rulesets/${id}`, {
+			method: "PUT",
+			body: payload
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/secrets/secrets.ts
+function scopeBase(repo, scope) {
+	switch (scope.kind) {
+		case "repo": return `${repoBase(repo)}/actions`;
+		case "environment": return `${repoBase(repo)}/environments/${scope.name}`;
+		case "organization": return `/orgs/${scope.org}/actions`;
+	}
+}
+function secrets(rest) {
+	return {
+		listSecrets: (repo, scope) => rest.request(`${scopeBase(repo, scope)}/secrets`).then((r) => r.secrets.map((s) => s.name)),
+		getPublicKey: (repo, scope) => rest.request(`${scopeBase(repo, scope)}/secrets/public-key`),
+		putSecret: (repo, scope, name, body) => rest.request(`${scopeBase(repo, scope)}/secrets/${name}`, {
+			method: "PUT",
+			body,
+			expectNoContent: true
+		}),
+		deleteSecret: (repo, scope, name) => rest.request(`${scopeBase(repo, scope)}/secrets/${name}`, {
+			method: "DELETE",
+			expectNoContent: true
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/security/security.ts
+function security(rest) {
+	return {
+		enableVulnerabilityAlerts: (repo) => rest.request(`${repoBase(repo)}/vulnerability-alerts`, {
+			method: "PUT",
+			expectNoContent: true
+		}),
+		enableAutomatedSecurityFixes: (repo) => rest.request(`${repoBase(repo)}/automated-security-fixes`, {
+			method: "PUT",
+			expectNoContent: true
+		}),
+		enableSecretScanning: (repo) => rest.request(repoBase(repo), {
+			method: "PATCH",
+			body: { security_and_analysis: {
+				secret_scanning: { status: "enabled" },
+				secret_scanning_push_protection: { status: "enabled" },
+				secret_scanning_validity_checks: { status: "enabled" },
+				secret_scanning_non_provider_patterns: { status: "enabled" }
+			} }
+		}),
+		enablePrivateVulnerabilityReporting: (repo) => rest.request(`${repoBase(repo)}/private-vulnerability-reporting`, {
+			method: "PUT",
+			expectNoContent: true
+		}),
+		enableDependencyGraph: (repo) => rest.request(repoBase(repo), {
+			method: "PATCH",
+			body: { security_and_analysis: {
+				dependency_graph: { status: "enabled" },
+				dependency_graph_autosubmit_action: { status: "enabled" }
+			} }
+		}),
+		enableCodeScanning: (repo) => rest.request(`${repoBase(repo)}/code-scanning/default-setup`, {
+			method: "PATCH",
+			body: {
+				state: "configured",
+				query_suite: "extended",
+				threat_model: "remote_and_local"
+			}
+		}),
+		disableDefaultCodeScanning: (repo) => rest.request(`${repoBase(repo)}/code-scanning/default-setup`, {
+			method: "PATCH",
+			body: { state: "not-configured" }
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/teams/teams.ts
+function teams(rest) {
+	return { addRepo: (org, teamSlug, owner, repo, permission) => rest.request(`/orgs/${org}/teams/${teamSlug}/repos/${owner}/${repo}`, {
+		method: "PUT",
+		body: { permission }
+	}) };
+}
+//#endregion
+//#region ../../../../../src/topics/topics.ts
+function topics(rest) {
+	return { setTopics: (repo, names) => rest.request(`${repoBase(repo)}/topics`, {
+		method: "PUT",
+		body: { names }
+	}) };
+}
+//#endregion
+//#region ../../../../../src/user/user.ts
+function user(rest) {
+	return { getCurrentUser: () => rest.request("/user") };
+}
+//#endregion
+//#region ../../../../../src/workflows/workflows.ts
+function workflows(rest) {
+	return {
+		listRuns: (repo, filter) => {
+			const params = new URLSearchParams();
+			if (filter?.branch) params.set("branch", filter.branch);
+			if (filter?.limit) params.set("per_page", String(filter.limit));
+			if (filter?.status) params.set("status", filter.status);
+			const qs = params.toString();
+			const path = qs ? `${repoBase(repo)}/actions/runs?${qs}` : `${repoBase(repo)}/actions/runs`;
+			return rest.request(path).then((r) => r.workflow_runs);
+		},
+		getRun: (repo, id) => rest.request(`${repoBase(repo)}/actions/runs/${id}`),
+		/**
+		* Triggers a `workflow_dispatch` run. `workflowFile` is the workflow's
+		* filename (e.g. `"platform.dispatchedCheck.yml"`) — GitHub accepts the
+		* filename directly, no numeric workflow ID lookup needed. Fire-and-forget:
+		* the API returns `204` with no run ID, so callers needing to correlate
+		* the resulting run back to this call must pass their own correlation
+		* value through `inputs` (visible in the Actions UI/logs — never a secret).
+		*/
+		createWorkflowDispatch: (repo, workflowFile, ref, inputs) => rest.request(`${repoBase(repo)}/actions/workflows/${workflowFile}/dispatches`, {
+			method: "POST",
+			body: {
+				ref,
+				inputs
+			},
+			expectNoContent: true
+		})
+	};
+}
+//#endregion
+//#region ../../../../../src/app-auth/pem.ts
+/**
+* PEM/DER handling for GitHub App private keys — Web Crypto only (no
+* `node:crypto`), so this runs unchanged on Cloudflare Workers (no
+* `nodejs_compat` needed) and in Node.
+*
+* GitHub hands out App private keys in PKCS#1 ("-----BEGIN RSA PRIVATE
+* KEY-----") by default; `SubtleCrypto.importKey("pkcs8", …)` only
+* accepts PKCS#8 ("-----BEGIN PRIVATE KEY-----"). `pkcs1ToPkcs8` wraps a
+* PKCS#1 `RSAPrivateKey` DER in the fixed `PrivateKeyInfo` DER structure
+* PKCS#8 requires — a fixed `AlgorithmIdentifier` prefix for
+* `rsaEncryption` (OID 1.2.840.113549.1.1.1) around the unchanged
+* PKCS#1 bytes. Verified against a real generated key pair: imported,
+* signed, and checked against `node:crypto`'s `verify()` on the
+* original key's public half.
+*/
+function pemToDer(pem) {
+	const base64 = pem.replace(/-----BEGIN [^-]+-----/, "").replace(/-----END [^-]+-----/, "").replace(/\s/g, "");
+	return Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+}
+function concat(...arrays) {
+	const total = arrays.reduce((sum, a) => sum + a.length, 0);
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const a of arrays) {
+		out.set(a, offset);
+		offset += a.length;
+	}
+	return out;
+}
+function encodeDerLength(len) {
+	/* istanbul ignore next -- see comment above */
+	if (len < 128) return new Uint8Array([len]);
+	const bytes = [];
+	let n = len;
+	while (n > 0) {
+		bytes.unshift(n & 255);
+		n >>= 8;
+	}
+	return new Uint8Array([128 | bytes.length, ...bytes]);
+}
+function derEncode(tag, content) {
+	return concat(new Uint8Array([tag]), encodeDerLength(content.length), content);
+}
+/** SEQUENCE { OID rsaEncryption, NULL } — the fixed PKCS#8 AlgorithmIdentifier for RSA. */
+const RSA_ALGORITHM_IDENTIFIER = new Uint8Array([
+	48,
+	13,
+	6,
+	9,
+	42,
+	134,
+	72,
+	134,
+	247,
+	13,
+	1,
+	1,
+	1,
+	5,
+	0
+]);
+function pkcs1ToPkcs8(pkcs1) {
+	const version = new Uint8Array([
+		2,
+		1,
+		0
+	]);
+	const octetString = derEncode(4, pkcs1);
+	return derEncode(48, concat(version, RSA_ALGORITHM_IDENTIFIER, octetString));
+}
+/** Imports a PEM-encoded RSA private key — PKCS#1 or PKCS#8, either works — for RS256 signing. */
+async function importRsaPrivateKey(pem) {
+	const der = pemToDer(pem);
+	const pkcs8Der = (pem.includes("BEGIN RSA PRIVATE KEY") ? pkcs1ToPkcs8(der) : der).slice();
+	return crypto.subtle.importKey("pkcs8", pkcs8Der, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+}
+/** Base64url (no padding) — the encoding both JWT segments and the signature use. */
+function base64UrlEncode(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//#endregion
+//#region ../../../../../src/app-auth/app-auth.ts
+/**
+* GitHub App authentication — a signed App JWT, exchanged for a
+* short-lived installation access token, exchanged for a ready-to-use
+* `GitHubClient`. Web Crypto only (see `pem.ts`), so this runs unchanged
+* on Cloudflare Workers and in Node — no vendor-specific JWT library, no
+* `nodejs_compat` flag.
+*
+* https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app
+* https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation
+*/
+const CLOCK_DRIFT_BUFFER_SECONDS = 60;
+/** GitHub rejects an App JWT with more than 10 minutes between iat and exp. */
+const JWT_LIFETIME_SECONDS = 600;
+/**
+* Signs a JWT identifying this App (not a specific installation) — the
+* credential used only to request an installation access token, never
+* to call the REST API directly.
+*/
+async function createAppJWT(creds, now = Date.now()) {
+	const key = await importRsaPrivateKey(creds.privateKey);
+	const iat = Math.floor(now / 1e3) - CLOCK_DRIFT_BUFFER_SECONDS;
+	const exp = iat + JWT_LIFETIME_SECONDS;
+	const signingInput = `${base64UrlEncode(new TextEncoder().encode(JSON.stringify({
+		alg: "RS256",
+		typ: "JWT"
+	})))}.${base64UrlEncode(new TextEncoder().encode(JSON.stringify({
+		iat,
+		exp,
+		iss: creds.appId
+	})))}`;
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(signingInput));
+	return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
+}
+/**
+* Exchanges an App JWT for an installation access token — the credential
+* that actually authenticates REST calls, scoped to exactly one
+* installation (D10: never a hardcoded org — the caller supplies which
+* installation, from the webhook payload that triggered this).
+*/
+async function getInstallationAccessToken(creds, installationId, opts = {}) {
+	const jwt = await createAppJWT(creds);
+	const baseUrl = opts.baseUrl ?? "https://api.github.com";
+	const res = await (opts.fetch ?? globalThis.fetch)(`${baseUrl}/app/installations/${installationId}/access_tokens`, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${jwt}`,
+			accept: "application/vnd.github+json",
+			"x-github-api-version": "2022-11-28"
+		}
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new ProviderApiError(`GitHub POST /app/installations/${installationId}/access_tokens → ${res.status}`, res.status, body);
+	}
+	const json = await res.json();
+	return {
+		token: json.token,
+		expiresAt: json.expires_at
+	};
+}
+/** The whole flow in one call — an already-authenticated `GitHubClient` scoped to one installation. */
+async function createInstallationClient(creds, installationId, opts = {}) {
+	const { token } = await getInstallationAccessToken(creds, installationId, opts);
+	return createGitHubClient({
+		token,
+		baseUrl: opts.baseUrl,
+		fetch: opts.fetch
+	});
+}
+//#endregion
+//#region ../../../../../src/webhooks/webhooks.ts
+/**
+* GitHub's own webhook mechanics — signature verification and header/
+* payload shapes. Pure functions, no REST call, no auth token: these
+* operate on an *inbound* delivery, the mirror of everything else this
+* package does (outbound REST calls), so they're standalone exports
+* rather than part of `createGitHubClient()`'s returned object.
+*
+* A consumer (a GitHub App receiving webhooks) owns what to *do* with a
+* verified delivery — which event categories matter, how to normalize
+* them — the same split `holocron-plugin-clerk`'s `parseWebhook` draws
+* between Svix verification and Clerk-specific `AuthEvent` normalization,
+* just with the verification half living here instead of inline, since
+* "how GitHub signs and shapes a webhook" is vendor knowledge this
+* package already owns for every other GitHub API surface.
+*/
+/**
+* Verifies a GitHub webhook delivery's `X-Hub-Signature-256` header —
+* HMAC-SHA256 over the raw body, keyed by the webhook's configured
+* secret, `timingSafeEqual`-compared.
+* https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
+*
+* Returns `false` (never throws) for any failure to verify — a missing/
+* empty secret, a missing/malformed signature header, or a mismatch —
+* so the caller decides how to surface that (e.g. as its own error type).
+*/
+function verifyGitHubWebhookSignature(input) {
+	if (!input.secret || !input.signature || !input.signature.startsWith("sha256=")) return false;
+	const bodyStr = typeof input.body === "string" ? input.body : input.body.toString("utf8");
+	const provided = Buffer.from(input.signature.slice(7), "hex");
+	const computed = createHmac("sha256", input.secret).update(bodyStr).digest();
+	return provided.length === computed.length && timingSafeEqual(provided, computed);
+}
+/** Extracts GitHub's three webhook headers, case-insensitively (Node's raw headers may arrive lower-cased, or as an array when a header repeats). */
+function parseGitHubWebhookHeaders(headers) {
+	const find = (name) => {
+		const target = name.toLowerCase();
+		for (const [k, v] of Object.entries(headers)) if (k.toLowerCase() === target) return Array.isArray(v) ? v[0] : v;
+	};
+	return {
+		event: find("x-github-event"),
+		delivery: find("x-github-delivery"),
+		signature: find("x-hub-signature-256")
+	};
+}
+//#endregion
+//#region ../../../../../src/index.ts
+function createGitHubClient(opts) {
+	const rest = createGitHubRestClient(opts);
+	const graphql = createGitHubGraphQLApiClient(opts);
+	return {
+		branches: branches(rest),
+		checks: checks(rest),
+		environments: environments(rest),
+		git: git(rest),
+		issues: issues(rest),
+		labels: labels(rest),
+		pages: pages(rest),
+		properties: properties(rest),
+		pulls: pulls(rest, graphql),
+		repos: repos(rest),
+		rulesets: rulesets(rest),
+		secrets: secrets(rest),
+		security: security(rest),
+		teams: teams(rest),
+		topics: topics(rest),
+		user: user(rest),
+		workflows: workflows(rest)
+	};
+}
+//#endregion
+export { createAppJWT, createGitHubClient, createInstallationClient, getInstallationAccessToken, parseGitHubWebhookHeaders, verifyGitHubWebhookSignature };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/github-client",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "A TypeScript client for the GitHub REST API",
   "keywords": [
     "github",
@@ -33,13 +33,13 @@
   ],
   "dependencies": {
     "@theholocron/observability": "^0.3.0",
-    "@theholocron/http-client": "^1.32.0"
+    "@theholocron/http-client": "^1.33.0"
   },
   "devDependencies": {
     "@theholocron/cli": "5.0.0-alpha.79",
     "@theholocron/eslint-config": "^8.4.3",
     "@theholocron/tsconfig": "^8.2.0",
-    "@theholocron/tsdown-config": "^8.5.2",
+    "@theholocron/tsdown-config": "^8.6.1",
     "@theholocron/vitest-config": "^8.2.0",
     "@types/node": "^26.4.1",
     "@vitest/coverage-v8": "^5.0.0",