@useairfoil/producer-github 0.0.1 → 0.0.3

package/dist/src-DKDUc00e.mjs

@@ -0,0 +1,1563 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { GitHubConfigDef, manifest } from "./manifest.mjs";
+import { Auth, Connector, ConnectorError, Cursor, Fetch, Iceberg, Metrics, Resource, Telemetry, Webhook } from "@useairfoil/connector-kit";
+import { Array, Clock, Config, Context, DateTime, Duration, Effect, Exit, Layer, Option, Order, Redacted, Result, Schedule, Schema, SchemaTransformation, Stream, Struct } from "effect";
+import { HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpServerResponse } from "effect/http";
+import { createHmac, createPrivateKey, sign, timingSafeEqual } from "node:crypto";
+//#region src/client/constants.ts
+const GITHUB_API_VERSION = "2026-03-10";
+const baseUrl = "https://api.github.com";
+//#endregion
+//#region src/client/auth.ts
+var auth_exports = /* @__PURE__ */ __exportAll({
+	GitHubAuth: () => GitHubAuth,
+	layer: () => layer$2,
+	make: () => make$2,
+	makeAppJwt: () => makeAppJwt
+});
+var GitHubAuth = class extends Context.Service()("@useairfoil/producer-github/GitHubAuth") {};
+const TokenResponseSchema = Schema.Struct({
+	token: Schema.String,
+	expires_at: Schema.DateFromString
+});
+const base64Url = (value) => Buffer.from(value).toString("base64url");
+/**
+* Signs the app JWT with RS256. GitHub allows at most 10 minutes, and asks for
+* `iat` 60 seconds in the past to allow for clock drift.
+*/
+const makeAppJwt = (options) => Effect.try({
+	try: () => {
+		const now = Math.floor(options.nowMillis / 1e3);
+		const signingInput = `${base64Url(JSON.stringify({
+			alg: "RS256",
+			typ: "JWT"
+		}))}.${base64Url(JSON.stringify({
+			iat: now - 60,
+			exp: now + 540,
+			iss: options.clientId
+		}))}`;
+		const key = createPrivateKey(options.privateKey.replace(/\\n/g, "\n"));
+		return `${signingInput}.${base64Url(sign("sha256", Buffer.from(signingInput), key))}`;
+	},
+	catch: (cause) => new ConnectorError({
+		message: "Invalid GitHub App private key",
+		cause
+	})
+});
+const make$2 = Effect.fnUntraced(function* (config) {
+	const client = (yield* HttpClient.HttpClient).pipe(HttpClient.retryTransient({
+		schedule: Schedule.exponential("250 millis").pipe(Schedule.jittered),
+		times: 3
+	}));
+	const path = `/app/installations/${config.installationId}/access_tokens`;
+	return yield* Auth.makeTokenCache({ acquire: Effect.gen(function* () {
+		const jwt = yield* makeAppJwt({
+			clientId: config.appClientId,
+			privateKey: Redacted.value(config.appPrivateKey),
+			nowMillis: yield* Clock.currentTimeMillis
+		});
+		const request = HttpClientRequest.post(`${baseUrl}${path}`).pipe(HttpClientRequest.bearerToken(jwt), HttpClientRequest.acceptJson, HttpClientRequest.setHeader("X-GitHub-Api-Version", GITHUB_API_VERSION));
+		const response = yield* client.execute(request).pipe(Effect.mapError((cause) => new ConnectorError({
+			message: "GitHub installation token request failed",
+			cause
+		})));
+		const body = yield* HttpClientResponse.matchStatus(response, {
+			"2xx": (ok) => HttpClientResponse.schemaBodyJson(TokenResponseSchema)(ok).pipe(Effect.mapError((cause) => new ConnectorError({
+				message: "Invalid GitHub installation token response",
+				cause
+			}))),
+			orElse: (failed) => Effect.fail(new ConnectorError({ message: `GitHub returned ${failed.status} for the installation token` }))
+		});
+		const now = yield* Clock.currentTimeMillis;
+		return {
+			value: Redacted.make(body.token),
+			expiresIn: Duration.millis(Math.max(body.expires_at.getTime() - now, 0))
+		};
+	}).pipe(Effect.tapError((error) => Telemetry.annotateError("api_auth", error)), Effect.withSpan(Telemetry.SpanName.apiFetch, {
+		kind: "client",
+		attributes: { [Telemetry.Attr.apiPath]: path }
+	})) });
+});
+const layer$2 = (config) => Layer.effect(GitHubAuth)(make$2(config));
+//#endregion
+//#region src/client/client.ts
+var client_exports = /* @__PURE__ */ __exportAll({
+	GitHubClient: () => GitHubClient,
+	layer: () => layer$1,
+	layerConfig: () => layerConfig$1,
+	make: () => make$1,
+	nextLink: () => nextLink,
+	withParams: () => withParams
+});
+const maxRetries = 5;
+const retryBaseDelay = Duration.millis(500);
+const requestTimeout = Duration.minutes(2);
+var GitHubClient = class extends Context.Service()("@useairfoil/producer-github/GitHubClient") {};
+const withParams = (path, params) => `${path}?${new URLSearchParams(params).toString()}`;
+const nextLink = (header) => Option.fromNullishOr(/<([^>]+)>;\s*rel="next"/.exec(header ?? "")?.[1]);
+const ErrorBodySchema = Schema.Struct({ message: Schema.optional(Schema.String) });
+const statusError = (response, path) => HttpClientResponse.schemaBodyJson(ErrorBodySchema)(response).pipe(Effect.map((body) => body.message), Effect.orElseSucceed(() => void 0), Effect.flatMap((detail) => Effect.fail(new ConnectorError({ message: `GitHub API returned ${response.status} for ${path}${detail ? `: ${detail}` : ""}` }))), Effect.tapError((error) => Telemetry.annotateError("api_status", error)));
+/**
+* GitHub answers rate limits with `403` or `429`. A `403` is a rate limit when
+* it has `retry-after`, `x-ratelimit-remaining: 0`, or a rate limit message;
+* otherwise it's a permission error.
+*/
+const isRateLimited = (response, body) => response.status === 429 || response.status === 403 && (response.headers["retry-after"] !== void 0 || response.headers["x-ratelimit-remaining"] === "0" || /rate limit/i.test(body));
+const rateLimitedResponse = (input) => HttpClientError.isHttpClientError(input) && input.reason._tag === "StatusCodeError" ? input.reason.response : void 0;
+const retrySchedule = Metrics.retrySchedule({
+	connector: manifest.name,
+	baseDelay: retryBaseDelay,
+	times: maxRetries
+}).pipe(Schedule.modifyDelay(({ input, duration, now, attempt }) => {
+	const response = rateLimitedResponse(input);
+	if (response === void 0) return Effect.succeed(duration);
+	const retryAfter = response.headers["retry-after"];
+	if (retryAfter !== void 0) return Effect.succeed(Duration.seconds(Number(retryAfter)));
+	if (response.headers["x-ratelimit-remaining"] === "0") return Effect.succeed(Duration.millis(Math.max(Number(response.headers["x-ratelimit-reset"]) * 1e3 - now, 0) + 1e3));
+	return Effect.succeed(Duration.minutes(2 ** (attempt - 1)));
+}));
+const make$1 = Effect.fnUntraced(function* () {
+	const auth = yield* GitHubAuth;
+	const client = (yield* HttpClient.HttpClient).pipe(HttpClient.mapRequest((request) => request.pipe(HttpClientRequest.acceptJson, HttpClientRequest.setHeader("X-GitHub-Api-Version", GITHUB_API_VERSION))), HttpClient.mapRequestEffect((request) => auth.get.pipe(Effect.map((token) => HttpClientRequest.bearerToken(request, token)))), HttpClient.transformResponse(Effect.flatMap((response) => Effect.flatMap(response.text, (body) => isRateLimited(response, body) ? Effect.fail(new HttpClientError.HttpClientError({ reason: new HttpClientError.StatusCodeError({
+		request: response.request,
+		response
+	}) })) : Effect.succeed(response)))), HttpClient.transform((effect) => Effect.timeout(effect, requestTimeout)), HttpClient.retryTransient({
+		schedule: retrySchedule,
+		while: (error) => rateLimitedResponse(error) !== void 0
+	}));
+	const get = (schema, url) => {
+		const fullUrl = url.startsWith("/") ? `${baseUrl}${url}` : url;
+		if (!fullUrl.startsWith(`https://api.github.com/`)) return Effect.fail(new ConnectorError({ message: `Not a GitHub API URL: ${url}` }));
+		const path = fullUrl.slice(22).split("?")[0] ?? fullUrl;
+		return client.execute(HttpClientRequest.get(fullUrl)).pipe(Effect.catchTag(["HttpClientError", "TimeoutError"], (error) => {
+			const response = rateLimitedResponse(error);
+			if (response !== void 0) return Effect.succeed(response);
+			return Telemetry.annotateError("api_http", error).pipe(Effect.andThen(Effect.fail(new ConnectorError({
+				message: `GitHub API request ${error._tag === "TimeoutError" ? "timed out" : "failed"} for ${path}`,
+				cause: error
+			}))));
+		}), Effect.flatMap((response) => HttpClientResponse.matchStatus(response, {
+			"2xx": (ok) => HttpClientResponse.schemaBodyJson(schema)(ok).pipe(Effect.tapError((error) => Telemetry.annotateError("api_decode", error)), Effect.mapError((cause) => new ConnectorError({
+				message: `Invalid GitHub API response for ${path}`,
+				cause
+			})), Effect.map((body) => ({
+				body,
+				next: nextLink(ok.headers.link)
+			}))),
+			orElse: (failed) => statusError(failed, path)
+		})), Effect.withSpan(Telemetry.SpanName.apiFetch, {
+			kind: "client",
+			attributes: {
+				[Telemetry.Attr.apiPath]: path,
+				"github.api.version": GITHUB_API_VERSION
+			}
+		}));
+	};
+	return GitHubClient.of({ get });
+});
+const layer$1 = (config) => Layer.effect(GitHubClient)(make$1()).pipe(Layer.provide(layer$2(config)));
+const layerConfig$1 = (config) => Layer.unwrap(Config.unwrap(config).pipe(Effect.map(layer$1)));
+//#endregion
+//#region src/schemas/shared.ts
+/** IDs and counts. Connector Kit maps whole numbers to Iceberg longs. */
+const Long = Schema.Int.pipe(Schema.decodeTo(Schema.BigInt, SchemaTransformation.transform({
+	decode: (value) => BigInt(value),
+	encode: (value) => Number(value)
+})));
+const Timestamp = Schema.DateFromString;
+/** Text GitHub can clear, such as a body. */
+const Text = Schema.NullOr(Schema.String).pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode: (value) => value ?? "",
+	encode: (value) => value
+})));
+/** `null` becomes an empty list. A webhook can leave the list out. */
+const optionalList = (item) => Schema.optionalKey(Schema.NullOr(Schema.Array(item)).pipe(Schema.decodeTo(Schema.Array(Schema.toType(item)), SchemaTransformation.transform({
+	decode: (value) => value ?? [],
+	encode: (value) => value
+}))));
+const user = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "GitHub user ID." })),
+	login: Schema.String.pipe(Schema.annotateKey({ description: "GitHub username." })),
+	type: Schema.String.pipe(Schema.annotateKey({ description: "Account type, such as User, Bot, or Organization." }))
+});
+const label = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Label ID." })),
+	name: Schema.String.pipe(Schema.annotateKey({ description: "Label name." }))
+});
+const milestone = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Milestone ID." })),
+	number: Long.pipe(Schema.annotateKey({ description: "Milestone number in the repository." })),
+	title: Schema.String.pipe(Schema.annotateKey({ description: "Milestone title." }))
+});
+const version = (object) => Schema.Date.pipe(Schema.annotateKey({ description: `Time GitHub last updated the ${object}.` }));
+/** For objects without an update time. A newer read wins. */
+const readVersion = (object) => Schema.Date.pipe(Schema.annotateKey({ description: `Time the connector read the ${object}. GitHub has no update time for it.` }));
+const deleted = (object) => Schema.optional(Schema.Boolean).pipe(Schema.annotateKey({ description: `Whether the ${object} was deleted in GitHub.` }));
+const ObjectRefSchema = Schema.Struct({ id: Long });
+//#endregion
+//#region src/schemas/check-runs.ts
+const CheckRunSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique check run ID." })),
+	version: readVersion("check run"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the check run." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the check run belongs to." })),
+	head_sha: Schema.String.pipe(Schema.annotateKey({ description: "SHA of the commit the check ran on." })),
+	name: Schema.String.pipe(Schema.annotateKey({ description: "Check name." })),
+	status: Schema.String.pipe(Schema.annotateKey({ description: "Status, such as queued, in_progress, or completed." })),
+	conclusion: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Result of a completed check, such as success or failure." })),
+	started_at: Schema.NullOr(Timestamp).pipe(Schema.annotateKey({ description: "Time the check started." })),
+	completed_at: Schema.NullOr(Timestamp).pipe(Schema.annotateKey({ description: "Time the check completed." })),
+	app: Schema.NullOr(Schema.Struct({
+		id: Long.pipe(Schema.annotateKey({ description: "GitHub App ID." })),
+		name: Schema.String.pipe(Schema.annotateKey({ description: "GitHub App name." }))
+	})).pipe(Schema.annotateKey({ description: "GitHub App that created the check, such as GitHub Actions." })),
+	check_suite: Schema.NullOr(Schema.Struct({ id: Long.pipe(Schema.annotateKey({ description: "Check suite ID." })) })).pipe(Schema.annotateKey({ description: "Check suite the check run belongs to." })),
+	output: Schema.Struct({
+		title: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Output title." })),
+		summary: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Output summary in Markdown." }))
+	}).pipe(Schema.annotateKey({ description: "Output the check reported." })),
+	external_id: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "ID the app gave the check." })),
+	details_url: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Details page from the app." })),
+	html_url: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Check run page on GitHub." }))
+}).annotate({ description: "Check runs, such as GitHub Actions jobs. Polled for default-branch commits; webhooks cover all branches." }).pipe(Iceberg.identifier("id"));
+const CheckRunObjectSchema = CheckRunSchema.mapFields((fields) => Struct.omit(fields, ["version", "repository_id"]));
+//#endregion
+//#region src/schemas/issue-comments.ts
+const IssueCommentSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique comment ID." })),
+	version: version("comment"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the comment." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the comment belongs to." })),
+	issue_number: Long.pipe(Schema.annotateKey({ description: "Number of the issue or pull request the comment is on, in its repository." })),
+	user: Schema.NullOr(user).pipe(Schema.annotateKey({ description: "Account that wrote the comment." })),
+	author_association: Schema.String.pipe(Schema.annotateKey({ description: "Author's relation to the repository, such as OWNER or CONTRIBUTOR." })),
+	body: Text.pipe(Schema.annotateKey({ description: "Comment in Markdown. Empty when not set." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the comment was written." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Comment on GitHub." })),
+	_deleted: deleted("comment")
+}).annotate({ description: "Comments on issues and pull requests. Pull request review comments are not included." }).pipe(Iceberg.identifier("id"));
+const IssueCommentObjectSchema = IssueCommentSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"issue_number",
+		"_deleted"
+	]),
+	updated_at: Timestamp,
+	issue_url: Schema.String.check(Schema.isPattern(/\/issues\/\d+$/))
+}));
+//#endregion
+//#region src/schemas/issues.ts
+const IssueSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique issue ID." })),
+	version: version("issue"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the issue." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the issue belongs to." })),
+	number: Long.pipe(Schema.annotateKey({ description: "Issue number in the repository." })),
+	title: Schema.String.pipe(Schema.annotateKey({ description: "Issue title." })),
+	body: Text.pipe(Schema.annotateKey({ description: "Issue description in Markdown. Empty when not set." })),
+	state: Schema.String.pipe(Schema.annotateKey({ description: "State: open or closed." })),
+	state_reason: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Why the issue was closed or reopened, such as completed or not_planned." })),
+	locked: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the conversation is locked." })),
+	user: Schema.NullOr(user).pipe(Schema.annotateKey({ description: "Account that opened the issue." })),
+	author_association: Schema.String.pipe(Schema.annotateKey({ description: "Author's relation to the repository, such as OWNER or CONTRIBUTOR." })),
+	labels: Schema.Array(label).pipe(Schema.annotateKey({ description: "Labels on the issue." })),
+	assignees: Schema.Array(user).pipe(Schema.annotateKey({ description: "Accounts assigned to the issue." })),
+	milestone: Schema.NullOr(milestone).pipe(Schema.annotateKey({ description: "Milestone of the issue." })),
+	comments: Long.pipe(Schema.annotateKey({ description: "Number of comments." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the issue was opened." })),
+	closed_at: Schema.NullOr(Timestamp).pipe(Schema.annotateKey({ description: "Time the issue was closed. Null while it is open." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Issue page on GitHub." })),
+	_deleted: deleted("issue")
+}).annotate({ description: "Issues in the installation's repositories. Pull requests are not included." }).pipe(Iceberg.identifier("id"));
+const IssueObjectSchema = IssueSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"labels",
+		"assignees",
+		"_deleted"
+	]),
+	updated_at: Timestamp,
+	labels: optionalList(label),
+	assignees: optionalList(user),
+	pull_request: Schema.optionalKey(Schema.Unknown)
+}));
+//#endregion
+//#region src/schemas/pull-request-review-comments.ts
+const PullRequestReviewCommentSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique review comment ID." })),
+	version: version("review comment"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the review comment." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the comment belongs to." })),
+	pull_request_number: Long.pipe(Schema.annotateKey({ description: "Number of the pull request the comment is on, in its repository." })),
+	pull_request_review_id: Schema.NullOr(Long).pipe(Schema.annotateKey({ description: "ID of the review the comment belongs to." })),
+	in_reply_to_id: Schema.optionalKey(Long).pipe(Schema.annotateKey({ description: "ID of the comment this one replies to." })),
+	user: Schema.NullOr(user).pipe(Schema.annotateKey({ description: "Account that wrote the comment." })),
+	author_association: Schema.String.pipe(Schema.annotateKey({ description: "Author's relation to the repository, such as OWNER or CONTRIBUTOR." })),
+	body: Schema.String.pipe(Schema.annotateKey({ description: "Comment in Markdown." })),
+	path: Schema.String.pipe(Schema.annotateKey({ description: "Path of the file the comment is on." })),
+	commit_id: Schema.String.pipe(Schema.annotateKey({ description: "SHA of the commit the comment is on now." })),
+	original_commit_id: Schema.String.pipe(Schema.annotateKey({ description: "SHA of the commit the comment was written on." })),
+	diff_hunk: Schema.String.pipe(Schema.annotateKey({ description: "Part of the diff the comment is on." })),
+	line: Schema.optionalKey(Schema.NullOr(Long)).pipe(Schema.annotateKey({ description: "Last line of the commented range in the current diff." })),
+	original_line: Schema.optionalKey(Schema.NullOr(Long)).pipe(Schema.annotateKey({ description: "Last line of the commented range in the original diff." })),
+	start_line: Schema.optionalKey(Schema.NullOr(Long)).pipe(Schema.annotateKey({ description: "First line of a multi-line comment." })),
+	side: Schema.optionalKey(Schema.NullOr(Schema.String)).pipe(Schema.annotateKey({ description: "Side of the diff: LEFT or RIGHT." })),
+	subject_type: Schema.optionalKey(Schema.String).pipe(Schema.annotateKey({ description: "What the comment is on: line or file." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the comment was written." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Comment on GitHub." })),
+	_deleted: deleted("review comment")
+}).annotate({ description: "Review comments on pull request diffs." }).pipe(Iceberg.identifier("id"));
+const PullRequestReviewCommentObjectSchema = PullRequestReviewCommentSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"pull_request_number",
+		"_deleted"
+	]),
+	updated_at: Timestamp,
+	pull_request_url: Schema.String.check(Schema.isPattern(/\/pulls\/\d+$/))
+}));
+//#endregion
+//#region src/schemas/pull-requests.ts
+const branch = Schema.Struct({
+	ref: Schema.String.pipe(Schema.annotateKey({ description: "Branch name." })),
+	sha: Schema.String.pipe(Schema.annotateKey({ description: "Commit SHA." })),
+	label: Schema.String.pipe(Schema.annotateKey({ description: "Owner and branch, such as octocat:main." }))
+});
+const PullRequestSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique pull request ID. Not the ID of its issue." })),
+	version: version("pull request"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the pull request." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the pull request belongs to." })),
+	number: Long.pipe(Schema.annotateKey({ description: "Pull request number in the repository." })),
+	title: Schema.String.pipe(Schema.annotateKey({ description: "Pull request title." })),
+	body: Text.pipe(Schema.annotateKey({ description: "Pull request description in Markdown. Empty when not set." })),
+	state: Schema.String.pipe(Schema.annotateKey({ description: "State: open or closed. Merged pull requests are closed." })),
+	draft: Schema.optionalKey(Schema.Boolean).pipe(Schema.annotateKey({ description: "Whether the pull request is a draft." })),
+	locked: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the conversation is locked." })),
+	user: Schema.NullOr(user).pipe(Schema.annotateKey({ description: "Account that opened the pull request." })),
+	author_association: Schema.String.pipe(Schema.annotateKey({ description: "Author's relation to the repository, such as OWNER or CONTRIBUTOR." })),
+	labels: Schema.Array(label).pipe(Schema.annotateKey({ description: "Labels on the pull request." })),
+	assignees: Schema.Array(user).pipe(Schema.annotateKey({ description: "Accounts assigned to the pull request." })),
+	requested_reviewers: Schema.Array(user).pipe(Schema.annotateKey({ description: "Accounts asked to review that have not reviewed yet." })),
+	milestone: Schema.NullOr(milestone).pipe(Schema.annotateKey({ description: "Milestone of the pull request." })),
+	head: branch.pipe(Schema.annotateKey({ description: "Branch the changes come from." })),
+	base: branch.pipe(Schema.annotateKey({ description: "Branch the changes merge into." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the pull request was opened." })),
+	closed_at: Schema.NullOr(Timestamp).pipe(Schema.annotateKey({ description: "Time the pull request was closed. Null while it is open." })),
+	merged_at: Schema.NullOr(Timestamp).pipe(Schema.annotateKey({ description: "Time the pull request was merged." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Pull request page on GitHub." }))
+}).annotate({ description: "Pull requests in the installation's repositories." }).pipe(Iceberg.identifier("id"));
+const PullRequestObjectSchema = PullRequestSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"labels",
+		"assignees",
+		"requested_reviewers"
+	]),
+	updated_at: Timestamp,
+	labels: optionalList(label),
+	assignees: optionalList(user),
+	requested_reviewers: optionalList(user)
+}));
+//#endregion
+//#region src/schemas/releases.ts
+const asset = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Asset ID." })),
+	name: Schema.String.pipe(Schema.annotateKey({ description: "File name." })),
+	label: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Label shown instead of the name." })),
+	state: Schema.String.pipe(Schema.annotateKey({ description: "State: uploaded or open." })),
+	content_type: Schema.String.pipe(Schema.annotateKey({ description: "Media type of the file." })),
+	size: Long.pipe(Schema.annotateKey({ description: "Size in bytes." })),
+	download_count: Long.pipe(Schema.annotateKey({ description: "Number of downloads when the release last changed." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the asset was uploaded." })),
+	updated_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the asset last changed." })),
+	browser_download_url: Schema.String.pipe(Schema.annotateKey({ description: "Download link." }))
+});
+const ReleaseSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique release ID." })),
+	version: version("release"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the release." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the release belongs to." })),
+	tag_name: Schema.String.pipe(Schema.annotateKey({ description: "Tag of the release." })),
+	target_commitish: Schema.String.pipe(Schema.annotateKey({ description: "Branch or commit the tag was created from." })),
+	name: Text.pipe(Schema.annotateKey({ description: "Release title. Empty when not set." })),
+	body: Text.pipe(Schema.annotateKey({ description: "Release notes in Markdown. Empty when not set." })),
+	draft: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the release is a draft." })),
+	prerelease: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the release is a pre-release." })),
+	author: user.pipe(Schema.annotateKey({ description: "Account that created the release." })),
+	assets: Schema.Array(asset).pipe(Schema.annotateKey({ description: "Files attached to the release." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the release was created." })),
+	published_at: Schema.NullOr(Timestamp).pipe(Schema.annotateKey({ description: "Time the release was published." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Release page on GitHub." })),
+	_deleted: deleted("release")
+}).annotate({ description: "Releases in the installation's repositories, with their assets." }).pipe(Iceberg.identifier("id"));
+const ReleaseObjectSchema = ReleaseSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"_deleted"
+	]),
+	updated_at: Schema.optionalKey(Schema.NullOr(Timestamp))
+}));
+//#endregion
+//#region src/schemas/repositories.ts
+const RepositorySchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique repository ID." })),
+	version: version("repository"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the repository." })),
+	name: Schema.String.pipe(Schema.annotateKey({ description: "Repository name." })),
+	full_name: Schema.String.pipe(Schema.annotateKey({ description: "Owner and name, such as octo-org/octo-repo." })),
+	owner: user.pipe(Schema.annotateKey({ description: "Account that owns the repository." })),
+	private: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the repository is private." })),
+	visibility: Schema.optionalKey(Schema.String).pipe(Schema.annotateKey({ description: "Visibility: public, private, or internal." })),
+	description: Text.pipe(Schema.annotateKey({ description: "Repository description. Empty when not set." })),
+	fork: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the repository is a fork." })),
+	archived: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the repository is archived." })),
+	disabled: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether the repository is disabled." })),
+	default_branch: Schema.String.pipe(Schema.annotateKey({ description: "Default branch name." })),
+	language: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Main language GitHub detected." })),
+	topics: Schema.Array(Schema.String).pipe(Schema.annotateKey({ description: "Repository topics." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Repository page on GitHub." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the repository was created." })),
+	_deleted: deleted("repository")
+}).annotate({ description: "Repositories the GitHub App installation can read." }).pipe(Iceberg.identifier("id"));
+const RepositoryObjectSchema = RepositorySchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"topics",
+		"_deleted"
+	]),
+	updated_at: Timestamp,
+	topics: optionalList(Schema.String)
+}));
+const RepositoryRefSchema = Schema.Struct({
+	id: Schema.Number,
+	full_name: Schema.String,
+	has_issues: Schema.Boolean,
+	has_pull_requests: Schema.Boolean.pipe(Schema.withDecodingDefaultKey(Effect.succeed(true))),
+	size: Schema.Number
+});
+//#endregion
+//#region src/schemas/workflow-runs.ts
+const WorkflowRunSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique workflow run ID." })),
+	version: version("workflow run"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the run." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the run belongs to." })),
+	workflow_id: Long.pipe(Schema.annotateKey({ description: "ID of the workflow." })),
+	name: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Workflow name." })),
+	display_title: Schema.String.pipe(Schema.annotateKey({ description: "Title of the run, such as the commit message." })),
+	path: Schema.String.pipe(Schema.annotateKey({ description: "Path of the workflow file." })),
+	event: Schema.String.pipe(Schema.annotateKey({ description: "Event that started the run, such as push." })),
+	status: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Status, such as queued, in_progress, or completed." })),
+	conclusion: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Result of a completed run, such as success or failure." })),
+	head_branch: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Branch the run is for." })),
+	head_sha: Schema.String.pipe(Schema.annotateKey({ description: "SHA of the commit the run is for." })),
+	run_number: Long.pipe(Schema.annotateKey({ description: "Run number of the workflow." })),
+	run_attempt: Schema.optionalKey(Long).pipe(Schema.annotateKey({ description: "Attempt number. Re-runs count up." })),
+	check_suite_id: Schema.optionalKey(Long).pipe(Schema.annotateKey({ description: "ID of the run's check suite." })),
+	actor: Schema.optionalKey(user).pipe(Schema.annotateKey({ description: "Account that started the first attempt." })),
+	triggering_actor: Schema.optionalKey(user).pipe(Schema.annotateKey({ description: "Account that started the latest attempt." })),
+	pull_requests: Schema.Array(Schema.Struct({
+		id: Long.pipe(Schema.annotateKey({ description: "Pull request ID." })),
+		number: Long.pipe(Schema.annotateKey({ description: "Pull request number." }))
+	})).pipe(Schema.annotateKey({ description: "Pull requests the run is for. Empty for forks." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the run was created." })),
+	run_started_at: Schema.optionalKey(Timestamp).pipe(Schema.annotateKey({ description: "Time the latest attempt started." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Run page on GitHub." }))
+}).annotate({ description: "GitHub Actions workflow runs in the installation's repositories." }).pipe(Iceberg.identifier("id"));
+const WorkflowRunObjectSchema = WorkflowRunSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"pull_requests"
+	]),
+	updated_at: Timestamp,
+	pull_requests: Schema.NullOr(fields.pull_requests)
+}));
+//#endregion
+//#region src/schemas/events.ts
+/**
+* The webhook route passes the payload on as it is. GitHub puts the event name
+* in a header, so each resource decodes its own event.
+*/
+const WebhookPayloadSchema = Schema.Record(Schema.String, Schema.Unknown);
+const InstallationEventSchema = Schema.Struct({ installation: Schema.optional(Schema.Struct({ id: Schema.Number })) });
+/** For handlers that read the API again. */
+const RepositoryNameSchema = Schema.Struct({
+	id: Long,
+	full_name: Schema.String
+});
+/** A transferred issue no longer exists in its old repository. */
+const IssueRemovedEventSchema = Schema.Struct({
+	action: Schema.Literals(["deleted", "transferred"]),
+	issue: ObjectRefSchema
+});
+const IssuesEventSchema = Schema.Union([IssueRemovedEventSchema, Schema.Struct({
+	action: Schema.String,
+	repository: RepositoryNameSchema,
+	issue: IssueObjectSchema
+})]);
+const IssueCommentDeletedEventSchema = Schema.Struct({
+	action: Schema.Literal("deleted"),
+	comment: ObjectRefSchema
+});
+const IssueCommentEventSchema = Schema.Union([IssueCommentDeletedEventSchema, Schema.Struct({
+	action: Schema.String,
+	repository: ObjectRefSchema,
+	comment: IssueCommentObjectSchema
+})]);
+const PullRequestReviewCommentDeletedEventSchema = Schema.Struct({
+	action: Schema.Literal("deleted"),
+	comment: ObjectRefSchema
+});
+const PullRequestReviewCommentEventSchema = Schema.Union([PullRequestReviewCommentDeletedEventSchema, Schema.Struct({
+	action: Schema.String,
+	repository: ObjectRefSchema,
+	comment: PullRequestReviewCommentObjectSchema
+})]);
+const PullRequestEventSchema = Schema.Struct({
+	repository: RepositoryNameSchema,
+	pull_request: PullRequestObjectSchema
+});
+const RepositoryDeletedEventSchema = Schema.Struct({
+	action: Schema.Literal("deleted"),
+	repository: ObjectRefSchema
+});
+const RepositoryEventSchema = Schema.Union([RepositoryDeletedEventSchema, Schema.Struct({
+	action: Schema.String,
+	repository: RepositoryObjectSchema
+})]);
+const ReleaseDeletedEventSchema = Schema.Struct({
+	action: Schema.Literal("deleted"),
+	release: ObjectRefSchema
+});
+const ReleaseEventSchema = Schema.Union([ReleaseDeletedEventSchema, Schema.Struct({
+	action: Schema.String,
+	repository: ObjectRefSchema,
+	release: ReleaseObjectSchema
+})]);
+const WorkflowRunEventSchema = Schema.Struct({
+	repository: ObjectRefSchema,
+	workflow_run: WorkflowRunObjectSchema
+});
+const PushEventSchema = Schema.Struct({
+	ref: Schema.String,
+	before: Schema.String,
+	after: Schema.String,
+	repository: RepositoryNameSchema.mapFields(Struct.assign({ default_branch: Schema.String }))
+});
+const PullRequestReviewEventSchema = Schema.Struct({
+	repository: RepositoryNameSchema,
+	pull_request: Schema.Struct({ number: Long }),
+	review: ObjectRefSchema
+});
+const PullRequestCommitsEventSchema = Schema.Struct({
+	action: Schema.String,
+	changes: Schema.optionalKey(Schema.Struct({ base: Schema.optionalKey(Schema.Unknown) })),
+	repository: RepositoryNameSchema,
+	pull_request: Schema.Struct({
+		number: Long,
+		updated_at: Timestamp
+	})
+});
+const CheckRunEventSchema = Schema.Struct({
+	repository: RepositoryNameSchema,
+	check_run: ObjectRefSchema
+});
+const WorkflowJobEventSchema = Schema.Struct({
+	repository: RepositoryNameSchema,
+	workflow_job: ObjectRefSchema
+});
+/** The status payload is flat. */
+const StatusEventSchema = Schema.Struct({
+	id: Long,
+	sha: Schema.String,
+	repository: RepositoryNameSchema
+});
+//#endregion
+//#region src/schemas/commits.ts
+const gitActor = Schema.Struct({
+	name: Schema.String.pipe(Schema.annotateKey({ description: "Name in the commit." })),
+	date: Timestamp.pipe(Schema.annotateKey({ description: "Time in the commit." }))
+});
+/**
+* The GitHub account of a commit's author or committer. GitHub sends `null` or
+* `{}` when the email matches no account, and both become `null`.
+*/
+const account = Schema.NullOr(Schema.Union([user, Schema.Struct({})])).pipe(Schema.decodeTo(Schema.NullOr(Schema.toType(user)), SchemaTransformation.transform({
+	decode: (value) => value !== null && "id" in value ? value : null,
+	encode: (value) => value
+})));
+const CommitSchema = Schema.Struct({
+	key: Schema.String.pipe(Schema.annotateKey({ description: "Repository ID and SHA, such as `1406396726:9eb3a7d`." })),
+	version: Schema.Date.pipe(Schema.annotateKey({ description: "Commit time. A commit never changes." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the commit is in." })),
+	sha: Schema.String.pipe(Schema.annotateKey({ description: "Commit SHA." })),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the commit." })),
+	message: Schema.String.pipe(Schema.annotateKey({ description: "Commit message." })),
+	author: gitActor.pipe(Schema.annotateKey({ description: "Author name and time from the commit." })),
+	committer: gitActor.pipe(Schema.annotateKey({ description: "Committer name and time from the commit." })),
+	author_user: account.pipe(Schema.annotateKey({ description: "GitHub account of the author." })),
+	committer_user: account.pipe(Schema.annotateKey({ description: "GitHub account of the committer." })),
+	parents: Schema.Array(Schema.String).pipe(Schema.annotateKey({ description: "SHAs of the parent commits." })),
+	verified: Schema.Boolean.pipe(Schema.annotateKey({ description: "Whether GitHub verified the commit signature." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Commit page on GitHub." }))
+}).annotate({ description: "Commits on the default branch of the installation's repositories." }).pipe(Iceberg.identifier("key"));
+const CommitObjectSchema = Schema.Struct({
+	sha: Schema.String,
+	node_id: Schema.String,
+	commit: Schema.Struct({
+		author: gitActor,
+		committer: gitActor,
+		message: Schema.String,
+		verification: Schema.optionalKey(Schema.Struct({ verified: Schema.Boolean }))
+	}),
+	author: account,
+	committer: account,
+	parents: Schema.Array(Schema.Struct({ sha: Schema.String })),
+	html_url: Schema.String
+});
+//#endregion
+//#region src/resources/shared.ts
+const timestamps = {
+	createdAt: (item) => item.created_at,
+	updatedAt: (item) => item.updated_at
+};
+const changesInterval = Duration.minutes(15);
+const maxChangesPagesPerRun = 20;
+const changesOverlap = Duration.minutes(5);
+const repositoryListTtl = Duration.minutes(5);
+const installationRepositoriesPath = "/installation/repositories";
+const repositoryPage = (item) => Schema.Struct({ repositories: Schema.Array(item) });
+/** Some lists wrap their items, such as `{ total_count, workflow_runs: [...] }`. */
+const wrappedList = (key, item) => Schema.Struct({ [key]: Schema.Array(item) }).pipe(Schema.decodeTo(Schema.Array(Schema.toType(item)), SchemaTransformation.transform({
+	decode: (page) => page[key],
+	encode: (items) => ({ [key]: items })
+})));
+const readPages = (client, pageSchema, url, keepGoing = () => true) => Stream.paginate(url, (current) => client.get(pageSchema, current).pipe(Effect.map((page) => [page.body, keepGoing(page.body) ? page.next : Option.none()]))).pipe(Stream.runCollect);
+/** Every repository the installation can read, ordered by ID. */
+const listRepositories = (client, schema) => readPages(client, wrappedList("repositories", schema), withParams(installationRepositoriesPath, { per_page: "100" })).pipe(Effect.map(Array.sort(Order.mapInput(Order.Number, (repository) => Number(repository.id)))));
+const cachedRepositoryRefs = (client) => listRepositories(client, RepositoryRefSchema).pipe(Effect.cachedWithTTL((exit) => Exit.isSuccess(exit) ? repositoryListTtl : 0));
+/**
+* `since` is when the last run started, and `repositoryIds` are the
+* repositories it read. Any other repository is new and is read from the start.
+* `pending` is set while a run is split.
+*/
+const ChangesCursorSchema = Schema.Struct({
+	since: Schema.DateTimeUtcFromString,
+	repositoryIds: Schema.optional(Schema.Array(Schema.Number)),
+	pending: Schema.optional(Schema.Struct({
+		until: Schema.DateTimeUtcFromString,
+		repositoryIds: Schema.Array(Schema.Number),
+		repositoryId: Schema.Number,
+		url: Schema.optional(Schema.String)
+	}))
+});
+const ChangesCursorCodec = Schema.Union([Schema.fromJsonString(ChangesCursorSchema), Schema.DateTimeUtcFromString.pipe(Schema.decodeTo(Schema.toType(ChangesCursorSchema), SchemaTransformation.transform({
+	decode: (since) => ({ since }),
+	encode: (cursor) => cursor.since
+})))]);
+const cursorError = (cause) => new ConnectorError({
+	message: "Invalid GitHub cursor",
+	cause
+});
+const decodeChangesCursor = (value) => Schema.decodeUnknownEffect(ChangesCursorCodec)(value).pipe(Effect.mapError(cursorError));
+const encodeChangesCursor = (cursor) => Schema.encodeEffect(Schema.fromJsonString(ChangesCursorSchema))(cursor).pipe(Effect.mapError(cursorError));
+/** When to read a repository's changes from. None means from the start. */
+const readFrom = (state, repositoryId) => state.repositoryIds === void 0 || state.repositoryIds.includes(repositoryId) ? Option.some(DateTime.toDateUtc(DateTime.subtractDuration(state.since, changesOverlap))) : Option.none();
+const isSince = (time, date) => Option.match(time, {
+	onNone: () => true,
+	onSome: (since) => date.getTime() >= since.getTime()
+});
+const readChanges = (cursor, repositories, toRows) => Effect.gen(function* () {
+	const state = yield* decodeChangesCursor(cursor);
+	const runStart = yield* DateTime.now;
+	const listed = yield* repositories;
+	return {
+		rows: toRows(listed.map((repository) => ({
+			repository,
+			since: readFrom(state, Number(repository.id))
+		}))),
+		cursor: yield* encodeChangesCursor({
+			since: runStart,
+			repositoryIds: listed.map((repository) => Number(repository.id))
+		})
+	};
+});
+const rowsOf = (toRow) => (items, repository) => Effect.succeed(items.map((item) => toRow(item, BigInt(repository.id))));
+const repoPath = (repository, path) => `/repos/${repository.full_name}/${path}`;
+/**
+* `rows` for a child resource, such as reviews of pull requests. Parents are
+* read one at a time, as GitHub asks. `readAt` is the version for children
+* without an update time.
+*/
+const childRows = (client, child) => (parents, repository) => Effect.gen(function* () {
+	const readAt = yield* DateTime.nowAsDate;
+	return (yield* Effect.forEach(parents, (parent) => readPages(client, child.pageSchema, withParams(repoPath(repository, child.path(parent)), {
+		...child.params,
+		per_page: "100"
+	})).pipe(Effect.map((children) => children.map((item) => child.toRow(item, parent, BigInt(repository.id), readAt)))))).flat();
+});
+/** Lists one item, then reads its rows, so a child resource checks its own call too. */
+const checkRepoResource = (client, spec) => Effect.gen(function* () {
+	const page = yield* client.get(repositoryPage(RepositoryRefSchema), withParams(installationRepositoriesPath, { per_page: "100" }));
+	const repository = Array.findFirst(page.body.repositories, spec.enabled);
+	if (Option.isSome(repository)) {
+		const items = yield* client.get(spec.pageSchema, withParams(repoPath(repository.value, spec.path), {
+			...spec.params,
+			per_page: "1"
+		}));
+		yield* spec.rows(items.body.filter(spec.keep), repository.value);
+	}
+});
+const BackfillCursorSchema = Schema.fromJsonString(Schema.Struct({
+	repositoryId: Schema.Number,
+	next: Schema.optional(Schema.String)
+}));
+const decodeBackfillCursor = (value) => Schema.decodeUnknownEffect(BackfillCursorSchema)(value).pipe(Effect.mapError(cursorError));
+const encodeBackfillCursor = (cursor) => Schema.encodeEffect(BackfillCursorSchema)(cursor).pipe(Effect.mapError(cursorError));
+const parseCutoff = (value) => DateTime.toDateUtc(DateTime.makeUnsafe(value));
+/**
+* Reads one repository at a time up to the cutoff, oldest first when the list
+* can sort. The cursor keeps the `next` URL, because the issues list pages
+* with a cursor.
+*/
+const backfillRepoResource = (client, repositories, spec) => Fetch.page({
+	pageCursor: Cursor.string(),
+	cutoff: Cursor.isoDateTime(),
+	fetch: ({ pageCursor, cutoff }) => Effect.gen(function* () {
+		const cutoffDate = parseCutoff(String(cutoff));
+		const listed = (yield* repositories).filter(spec.enabled);
+		const position = typeof pageCursor === "string" ? Option.some(yield* decodeBackfillCursor(pageCursor)) : Option.none();
+		const repository = Option.match(position, {
+			onNone: () => listed[0],
+			onSome: ({ repositoryId }) => listed.find((item) => item.id >= repositoryId)
+		});
+		if (repository === void 0) return {
+			rows: [],
+			hasMore: false
+		};
+		const url = Option.flatMap(position, ({ repositoryId, next }) => repositoryId === repository.id ? Option.fromNullishOr(next) : Option.none()).pipe(Option.getOrElse(() => withParams(repoPath(repository, spec.path), {
+			...spec.params,
+			...spec.order === "sorted" ? {
+				sort: "created",
+				direction: "asc"
+			} : {},
+			per_page: "100"
+		})));
+		const page = yield* client.get(spec.pageSchema, url);
+		const beforeCutoff = page.body.filter((item) => spec.createdAt(item).getTime() <= cutoffDate.getTime());
+		const rows = yield* spec.rows(beforeCutoff.filter(spec.keep), repository);
+		if (!(spec.order === "sorted" && beforeCutoff.length < page.body.length) && Option.isSome(page.next)) return {
+			rows,
+			nextPageCursor: yield* encodeBackfillCursor({
+				repositoryId: repository.id,
+				next: page.next.value
+			}),
+			hasMore: true
+		};
+		const following = listed.find((item) => item.id > repository.id);
+		if (following === void 0) return {
+			rows,
+			hasMore: false
+		};
+		return {
+			rows,
+			nextPageCursor: yield* encodeBackfillCursor({ repositoryId: following.id }),
+			hasMore: true
+		};
+	})
+});
+/**
+* One repository's changes, newest first, so an edit during the read repeats a
+* row instead of skipping one.
+*/
+const changesPages = (client, spec, repository, since, url) => {
+	const first = withParams(repoPath(repository, spec.path), {
+		...spec.params,
+		...spec.order === "sorted" ? {
+			sort: "updated",
+			direction: "desc"
+		} : {},
+		per_page: "100",
+		...spec.since && Option.isSome(since) ? { since: since.value.toISOString() } : {}
+	});
+	const isRecent = (item) => isSince(since, spec.updatedAt(item));
+	const { order, recentFor } = spec;
+	const createdFrom = Option.map(since, (date) => DateTime.toDateUtc(DateTime.subtractDuration(DateTime.fromDateUnsafe(date), recentFor ?? Duration.zero)));
+	const goOn = (items) => {
+		if (order === "sorted") return items.every(isRecent);
+		if (recentFor === void 0) return true;
+		return items.every((item) => isSince(createdFrom, spec.createdAt(item)));
+	};
+	return Stream.paginate(Option.getOrElse(url, () => first), (current) => Effect.gen(function* () {
+		const page = yield* client.get(spec.pageSchema, current);
+		const next = goOn(page.body) ? page.next : Option.none();
+		return [[{
+			repository,
+			rows: yield* spec.rows(page.body.filter((item) => isRecent(item) && spec.keep(item)), repository),
+			next
+		}], next];
+	}));
+};
+const changesRepoResource = (client, spec) => Fetch.changes({
+	cursor: Cursor.string(),
+	interval: changesInterval,
+	fetch: ({ cursor }) => Effect.gen(function* () {
+		const state = yield* decodeChangesCursor(String(cursor));
+		const listed = yield* listRepositories(client, RepositoryRefSchema);
+		const pending = state.pending;
+		const until = pending?.until ?? (yield* DateTime.now);
+		const repositoryIds = pending?.repositoryIds ?? listed.filter(spec.enabled).map((repository) => repository.id);
+		const repositories = listed.filter((repository) => spec.enabled(repository) && repositoryIds.includes(repository.id) && repository.id >= (pending?.repositoryId ?? 0));
+		const pages = yield* Stream.fromIterable(repositories).pipe(Stream.flatMap((repository) => changesPages(client, spec, repository, readFrom(state, repository.id), Option.fromNullishOr(pending?.repositoryId === repository.id ? pending.url : void 0))), Stream.take(maxChangesPagesPerRun), Stream.runCollect);
+		const rows = pages.flatMap((page) => page.rows);
+		const position = Option.flatMap(Array.last(pages), ({ repository, next }) => Option.match(next, {
+			onSome: (url) => Option.some({
+				repositoryId: repository.id,
+				url
+			}),
+			onNone: () => Array.findFirst(repositories, (item) => item.id > repository.id).pipe(Option.map((item) => ({ repositoryId: item.id })))
+		}));
+		if (pages.length === maxChangesPagesPerRun && Option.isSome(position)) return {
+			rows,
+			cursor: yield* encodeChangesCursor({
+				...state,
+				pending: {
+					until,
+					repositoryIds,
+					...position.value
+				}
+			}),
+			hasMore: true
+		};
+		return {
+			rows,
+			cursor: yield* encodeChangesCursor({
+				since: until,
+				repositoryIds
+			}),
+			hasMore: false
+		};
+	})
+});
+/** Schemas check that the URL ends in a number. */
+const numberAtEnd = (url) => BigInt(url.slice(url.lastIndexOf("/") + 1));
+const deleteRow = (id) => DateTime.nowAsDate.pipe(Effect.map((version) => ({
+	id,
+	version,
+	_deleted: true
+})));
+const decodeEvent = (schema, payload) => Schema.decodeUnknownEffect(schema)(payload).pipe(Effect.mapError((cause) => new ConnectorError({
+	message: "GitHub webhook payload does not decode",
+	cause
+})));
+//#endregion
+//#region src/resources/commits.ts
+const toRow$12 = ({ sha, node_id, commit, author, committer, parents, html_url }, repository_id) => ({
+	key: `${repository_id}:${sha}`,
+	version: commit.committer.date,
+	repository_id,
+	sha,
+	node_id,
+	message: commit.message,
+	author: commit.author,
+	committer: commit.committer,
+	author_user: author,
+	committer_user: committer,
+	parents: parents.map((parent) => parent.sha),
+	verified: commit.verification?.verified ?? false,
+	html_url
+});
+const committedAt = (item) => item.commit.committer.date;
+/** The list only has the default branch. */
+const commitSpec = {
+	path: "commits",
+	pageSchema: Schema.Array(CommitObjectSchema),
+	params: {},
+	since: true,
+	order: "newest",
+	createdAt: committedAt,
+	updatedAt: committedAt,
+	keep: () => true,
+	enabled: (repository) => repository.size > 0,
+	rows: rowsOf(toRow$12)
+};
+const noCommit = /^0+$/;
+const makeCommits = (client, repositories) => Resource.entity({
+	name: "commits",
+	rowSchema: CommitSchema,
+	version: "version",
+	check: checkRepoResource(client, commitSpec),
+	backfill: backfillRepoResource(client, repositories, commitSpec),
+	changes: changesRepoResource(client, commitSpec),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => Effect.gen(function* () {
+			const { ref, before, after, repository } = yield* decodeEvent(PushEventSchema, payload);
+			if (ref !== `refs/heads/${repository.default_branch}` || noCommit.test(before) || noCommit.test(after)) return [];
+			return (yield* readPages(client, wrappedList("commits", CommitObjectSchema), withParams(`/repos/${repository.full_name}/compare/${before}...${after}`, { per_page: "100" }))).map((commit) => toRow$12(commit, repository.id));
+		})
+	}
+});
+//#endregion
+//#region src/resources/check-runs.ts
+const toRow$11 = (checkRun, repository_id, version) => ({
+	...checkRun,
+	version,
+	repository_id
+});
+/** Check runs of default-branch commits. Webhooks also bring other branches. */
+const checkRunSpec = (client) => ({
+	...commitSpec,
+	rows: childRows(client, {
+		path: (commit) => `commits/${commit.sha}/check-runs`,
+		pageSchema: wrappedList("check_runs", CheckRunObjectSchema),
+		params: { filter: "all" },
+		toRow: (checkRun, _commit, repositoryId, readAt) => toRow$11(checkRun, repositoryId, readAt)
+	})
+});
+const makeCheckRuns = (client, repositories) => {
+	const spec = checkRunSpec(client);
+	return Resource.entity({
+		name: "check_runs",
+		rowSchema: CheckRunSchema,
+		version: "version",
+		check: checkRepoResource(client, spec),
+		backfill: backfillRepoResource(client, repositories, spec),
+		changes: changesRepoResource(client, spec),
+		webhook: {
+			schema: WebhookPayloadSchema,
+			handler: ({ payload }) => Effect.gen(function* () {
+				const { repository, check_run } = yield* decodeEvent(CheckRunEventSchema, payload);
+				const readAt = yield* DateTime.nowAsDate;
+				const page = yield* client.get(CheckRunObjectSchema, `/repos/${repository.full_name}/check-runs/${check_run.id}`);
+				return [toRow$11(page.body, repository.id, readAt)];
+			})
+		}
+	});
+};
+//#endregion
+//#region src/schemas/commit-statuses.ts
+const CommitStatusSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique status ID. Each new status of a context gets a new ID." })),
+	version: version("status"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the status." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the status belongs to." })),
+	sha: Schema.String.pipe(Schema.annotateKey({ description: "SHA of the commit the status is on." })),
+	state: Schema.String.pipe(Schema.annotateKey({ description: "State: error, failure, pending, or success." })),
+	context: Schema.String.pipe(Schema.annotateKey({ description: "Label that tells the status apart, such as ci/build." })),
+	description: Text.pipe(Schema.annotateKey({ description: "Short description. Empty when not set." })),
+	target_url: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Link the status points to." })),
+	creator: Schema.NullOr(user).pipe(Schema.annotateKey({ description: "Account that created the status." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the status was created." }))
+}).annotate({ description: "Commit statuses. Polled for default-branch commits; webhooks cover all branches." }).pipe(Iceberg.identifier("id"));
+const CommitStatusObjectSchema = CommitStatusSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"sha"
+	]),
+	updated_at: Timestamp
+}));
+//#endregion
+//#region src/resources/commit-statuses.ts
+const toRow$10 = ({ updated_at, ...rest }, sha, repository_id) => ({
+	...rest,
+	version: updated_at,
+	repository_id,
+	sha
+});
+/** Statuses of default-branch commits. Webhooks also bring other branches. */
+const commitStatusSpec = (client) => ({
+	...commitSpec,
+	rows: childRows(client, {
+		path: (commit) => `commits/${commit.sha}/statuses`,
+		pageSchema: Schema.Array(CommitStatusObjectSchema),
+		toRow: (status, commit, repositoryId) => toRow$10(status, commit.sha, repositoryId)
+	})
+});
+const makeCommitStatuses = (client, repositories) => {
+	const spec = commitStatusSpec(client);
+	return Resource.entity({
+		name: "commit_statuses",
+		rowSchema: CommitStatusSchema,
+		version: "version",
+		check: checkRepoResource(client, spec),
+		backfill: backfillRepoResource(client, repositories, spec),
+		changes: changesRepoResource(client, spec),
+		webhook: {
+			schema: WebhookPayloadSchema,
+			handler: ({ payload }) => Effect.gen(function* () {
+				const { id, sha, repository } = yield* decodeEvent(StatusEventSchema, payload);
+				const isStatus = (status) => status.id === id;
+				const status = yield* readPages(client, Schema.Array(CommitStatusObjectSchema), withParams(`/repos/${repository.full_name}/commits/${sha}/statuses`, { per_page: "100" }), (page) => !page.some(isStatus)).pipe(Effect.flatMap((statuses) => Effect.fromOption(Array.findFirst(statuses, isStatus), () => new ConnectorError({ message: `Commit status ${id} is not in the list` }))));
+				return [toRow$10(status, sha, repository.id)];
+			})
+		}
+	});
+};
+//#endregion
+//#region src/resources/issue-comments.ts
+const toRow$9 = ({ updated_at, issue_url, ...rest }, repository_id) => ({
+	...rest,
+	version: updated_at,
+	repository_id,
+	issue_number: numberAtEnd(issue_url)
+});
+const issueCommentSpec = {
+	path: "issues/comments",
+	pageSchema: Schema.Array(IssueCommentObjectSchema),
+	params: {},
+	since: true,
+	order: "sorted",
+	...timestamps,
+	keep: () => true,
+	enabled: (repository) => repository.has_issues || repository.has_pull_requests,
+	rows: rowsOf(toRow$9)
+};
+const makeIssueComments = (client, repositories) => Resource.entity({
+	name: "issue_comments",
+	rowSchema: IssueCommentSchema,
+	version: "version",
+	check: checkRepoResource(client, issueCommentSpec),
+	backfill: backfillRepoResource(client, repositories, issueCommentSpec),
+	changes: changesRepoResource(client, issueCommentSpec),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => Effect.gen(function* () {
+			const event = yield* decodeEvent(IssueCommentEventSchema, payload);
+			if (Schema.is(IssueCommentDeletedEventSchema)(event)) return [yield* deleteRow(event.comment.id)];
+			return [toRow$9(event.comment, event.repository.id)];
+		})
+	}
+});
+//#endregion
+//#region src/resources/issues.ts
+const toRow$8 = ({ updated_at, labels, assignees, pull_request: _pullRequest, ...rest }, repository_id) => ({
+	...rest,
+	version: updated_at,
+	repository_id,
+	labels: labels ?? [],
+	assignees: assignees ?? []
+});
+const hasLists$1 = ({ labels }) => labels !== void 0;
+const issueSpec = {
+	path: "issues",
+	pageSchema: Schema.Array(IssueObjectSchema),
+	params: { state: "all" },
+	since: true,
+	order: "sorted",
+	...timestamps,
+	keep: (item) => item.pull_request === void 0,
+	enabled: (repository) => repository.has_issues,
+	rows: rowsOf(toRow$8)
+};
+const makeIssues = (client, repositories) => Resource.entity({
+	name: "issues",
+	rowSchema: IssueSchema,
+	version: "version",
+	check: checkRepoResource(client, issueSpec),
+	backfill: backfillRepoResource(client, repositories, issueSpec),
+	changes: changesRepoResource(client, issueSpec),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => Effect.gen(function* () {
+			const event = yield* decodeEvent(IssuesEventSchema, payload);
+			if (Schema.is(IssueRemovedEventSchema)(event)) return [yield* deleteRow(event.issue.id)];
+			const { issue, repository } = event;
+			const full = hasLists$1(issue) ? issue : (yield* client.get(IssueObjectSchema, `/repos/${repository.full_name}/issues/${issue.number}`)).body;
+			return [toRow$8(full, repository.id)];
+		})
+	}
+});
+//#endregion
+//#region src/schemas/pull-request-commits.ts
+const PullRequestCommitSchema = Schema.Struct({
+	key: Schema.String.pipe(Schema.annotateKey({ description: "Repository ID, pull request number, and SHA, such as `1406396726:3:9eb3a7d`." })),
+	version: Schema.Date.pipe(Schema.annotateKey({ description: "Time GitHub last updated the pull request." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the pull request belongs to." })),
+	pull_request_number: Long.pipe(Schema.annotateKey({ description: "Pull request number in the repository." })),
+	sha: Schema.String.pipe(Schema.annotateKey({ description: "Commit SHA." })),
+	message: Schema.String.pipe(Schema.annotateKey({ description: "Commit message." })),
+	author: gitActor.pipe(Schema.annotateKey({ description: "Author name and time from the commit." })),
+	committer: gitActor.pipe(Schema.annotateKey({ description: "Committer name and time from the commit." })),
+	author_user: account.pipe(Schema.annotateKey({ description: "GitHub account of the author." })),
+	committer_user: account.pipe(Schema.annotateKey({ description: "GitHub account of the committer." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Commit page on GitHub." }))
+}).annotate({ description: "Commits in pull requests, up to 250 per pull request. Commits removed by a force push stay." }).pipe(Iceberg.identifier("key"));
+//#endregion
+//#region src/resources/pull-requests.ts
+const toRow$7 = ({ updated_at, labels, assignees, requested_reviewers, ...rest }, repository_id) => ({
+	...rest,
+	version: updated_at,
+	repository_id,
+	labels: labels ?? [],
+	assignees: assignees ?? [],
+	requested_reviewers: requested_reviewers ?? []
+});
+const hasLists = ({ assignees, requested_reviewers }) => assignees !== void 0 && requested_reviewers !== void 0;
+const pullRequestSpec = {
+	path: "pulls",
+	pageSchema: Schema.Array(PullRequestObjectSchema),
+	params: { state: "all" },
+	since: false,
+	order: "sorted",
+	...timestamps,
+	keep: () => true,
+	enabled: (repository) => repository.has_pull_requests,
+	rows: rowsOf(toRow$7)
+};
+const makePullRequests = (client, repositories) => Resource.entity({
+	name: "pull_requests",
+	rowSchema: PullRequestSchema,
+	version: "version",
+	check: checkRepoResource(client, pullRequestSpec),
+	backfill: backfillRepoResource(client, repositories, pullRequestSpec),
+	changes: changesRepoResource(client, pullRequestSpec),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => Effect.gen(function* () {
+			const { pull_request, repository } = yield* decodeEvent(PullRequestEventSchema, payload);
+			const full = hasLists(pull_request) ? pull_request : (yield* client.get(PullRequestObjectSchema, `/repos/${repository.full_name}/pulls/${pull_request.number}`)).body;
+			return [toRow$7(full, repository.id)];
+		})
+	}
+});
+//#endregion
+//#region src/resources/pull-request-commits.ts
+const toRow$6 = ({ sha, commit, author, committer, html_url }, pullRequest, repository_id) => ({
+	key: `${repository_id}:${pullRequest.number}:${sha}`,
+	version: pullRequest.updated_at,
+	repository_id,
+	pull_request_number: pullRequest.number,
+	sha,
+	message: commit.message,
+	author: commit.author,
+	committer: commit.committer,
+	author_user: author,
+	committer_user: committer,
+	html_url
+});
+const commitsPath = (pullRequest) => `pulls/${pullRequest.number}/commits`;
+const pullRequestCommitSpec = (client) => ({
+	...pullRequestSpec,
+	rows: childRows(client, {
+		path: (pullRequest) => commitsPath(pullRequest),
+		pageSchema: Schema.Array(CommitObjectSchema),
+		toRow: toRow$6
+	})
+});
+const commitActions = /* @__PURE__ */ new Set([
+	"opened",
+	"reopened",
+	"synchronize"
+]);
+const makePullRequestCommits = (client, repositories) => {
+	const spec = pullRequestCommitSpec(client);
+	return Resource.entity({
+		name: "pull_request_commits",
+		rowSchema: PullRequestCommitSchema,
+		version: "version",
+		check: checkRepoResource(client, spec),
+		backfill: backfillRepoResource(client, repositories, spec),
+		changes: changesRepoResource(client, spec),
+		webhook: {
+			schema: WebhookPayloadSchema,
+			handler: ({ payload }) => Effect.gen(function* () {
+				const { action, changes, repository, pull_request } = yield* decodeEvent(PullRequestCommitsEventSchema, payload);
+				if (!commitActions.has(action) && changes?.base === void 0) return [];
+				return (yield* readPages(client, Schema.Array(CommitObjectSchema), withParams(`/repos/${repository.full_name}/${commitsPath(pull_request)}`, { per_page: "100" }))).map((commit) => toRow$6(commit, pull_request, repository.id));
+			})
+		}
+	});
+};
+//#endregion
+//#region src/resources/pull-request-review-comments.ts
+const toRow$5 = ({ updated_at, pull_request_url, ...rest }, repository_id) => ({
+	...rest,
+	version: updated_at,
+	repository_id,
+	pull_request_number: numberAtEnd(pull_request_url)
+});
+const pullRequestReviewCommentSpec = {
+	path: "pulls/comments",
+	pageSchema: Schema.Array(PullRequestReviewCommentObjectSchema),
+	params: {},
+	since: true,
+	order: "sorted",
+	...timestamps,
+	keep: () => true,
+	enabled: (repository) => repository.has_pull_requests,
+	rows: rowsOf(toRow$5)
+};
+const makePullRequestReviewComments = (client, repositories) => Resource.entity({
+	name: "pull_request_review_comments",
+	rowSchema: PullRequestReviewCommentSchema,
+	version: "version",
+	check: checkRepoResource(client, pullRequestReviewCommentSpec),
+	backfill: backfillRepoResource(client, repositories, pullRequestReviewCommentSpec),
+	changes: changesRepoResource(client, pullRequestReviewCommentSpec),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => Effect.gen(function* () {
+			const event = yield* decodeEvent(PullRequestReviewCommentEventSchema, payload);
+			if (Schema.is(PullRequestReviewCommentDeletedEventSchema)(event)) return [yield* deleteRow(event.comment.id)];
+			return [toRow$5(event.comment, event.repository.id)];
+		})
+	}
+});
+//#endregion
+//#region src/schemas/pull-request-reviews.ts
+const PullRequestReviewSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique review ID." })),
+	version: readVersion("review"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the review." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the review belongs to." })),
+	pull_request_number: Long.pipe(Schema.annotateKey({ description: "Number of the pull request the review is on, in its repository." })),
+	user: Schema.NullOr(user).pipe(Schema.annotateKey({ description: "Account that wrote the review." })),
+	author_association: Schema.String.pipe(Schema.annotateKey({ description: "Author's relation to the repository, such as OWNER or CONTRIBUTOR." })),
+	state: Schema.String.pipe(Schema.annotateKey({ description: "State, such as APPROVED, CHANGES_REQUESTED, COMMENTED, or DISMISSED." })),
+	body: Schema.String.pipe(Schema.annotateKey({ description: "Review summary in Markdown." })),
+	commit_id: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "SHA of the commit the review is on." })),
+	submitted_at: Schema.optionalKey(Timestamp).pipe(Schema.annotateKey({ description: "Time the review was submitted." })),
+	html_url: Schema.String.pipe(Schema.annotateKey({ description: "Review on GitHub." }))
+}).annotate({ description: "Reviews on pull requests. Pending reviews are only visible to their author." }).pipe(Iceberg.identifier("id"));
+const PullRequestReviewObjectSchema = PullRequestReviewSchema.mapFields((fields) => Struct.omit(fields, [
+	"version",
+	"repository_id",
+	"pull_request_number"
+]));
+//#endregion
+//#region src/resources/pull-request-reviews.ts
+const toRow$4 = (review, pull_request_number, repository_id, version) => ({
+	...review,
+	version,
+	repository_id,
+	pull_request_number
+});
+/** A review bumps its pull request's update time, so changes follow pull requests. */
+const reviewSpec = (client) => ({
+	...pullRequestSpec,
+	rows: childRows(client, {
+		path: (pullRequest) => `pulls/${pullRequest.number}/reviews`,
+		pageSchema: Schema.Array(PullRequestReviewObjectSchema),
+		toRow: (review, pullRequest, repositoryId, readAt) => toRow$4(review, pullRequest.number, repositoryId, readAt)
+	})
+});
+const makePullRequestReviews = (client, repositories) => {
+	const spec = reviewSpec(client);
+	return Resource.entity({
+		name: "pull_request_reviews",
+		rowSchema: PullRequestReviewSchema,
+		version: "version",
+		check: checkRepoResource(client, spec),
+		backfill: backfillRepoResource(client, repositories, spec),
+		changes: changesRepoResource(client, spec),
+		webhook: {
+			schema: WebhookPayloadSchema,
+			handler: ({ payload }) => Effect.gen(function* () {
+				const { repository, pull_request, review } = yield* decodeEvent(PullRequestReviewEventSchema, payload);
+				const readAt = yield* DateTime.nowAsDate;
+				const page = yield* client.get(PullRequestReviewObjectSchema, `/repos/${repository.full_name}/pulls/${pull_request.number}/reviews/${review.id}`);
+				return [toRow$4(page.body, pull_request.number, repository.id, readAt)];
+			})
+		}
+	});
+};
+//#endregion
+//#region src/resources/releases.ts
+const updatedAt = (release) => release.updated_at ?? release.created_at;
+const toRow$3 = (release, repository_id) => ({
+	...Struct.omit(release, ["updated_at"]),
+	version: updatedAt(release),
+	repository_id
+});
+const releaseSpec = {
+	path: "releases",
+	pageSchema: Schema.Array(ReleaseObjectSchema),
+	params: {},
+	since: false,
+	order: "newest",
+	createdAt: (release) => release.created_at,
+	updatedAt,
+	keep: () => true,
+	enabled: () => true,
+	rows: rowsOf(toRow$3)
+};
+const makeReleases = (client, repositories) => Resource.entity({
+	name: "releases",
+	rowSchema: ReleaseSchema,
+	version: "version",
+	check: checkRepoResource(client, releaseSpec),
+	backfill: backfillRepoResource(client, repositories, releaseSpec),
+	changes: changesRepoResource(client, releaseSpec),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => Effect.gen(function* () {
+			const event = yield* decodeEvent(ReleaseEventSchema, payload);
+			if (Schema.is(ReleaseDeletedEventSchema)(event)) return [yield* deleteRow(event.release.id)];
+			return [toRow$3(event.release, event.repository.id)];
+		})
+	}
+});
+//#endregion
+//#region src/resources/repositories.ts
+const toRow$2 = ({ updated_at, topics, ...rest }) => ({
+	...rest,
+	version: updated_at,
+	topics: topics ?? [],
+	_deleted: false
+});
+const makeRepositories = (client) => Resource.entity({
+	name: "repositories",
+	rowSchema: RepositorySchema,
+	version: "version",
+	check: client.get(repositoryPage(RepositoryObjectSchema), withParams(installationRepositoriesPath, { per_page: "1" })).pipe(Effect.asVoid),
+	backfill: Fetch.page({
+		pageCursor: Cursor.string(),
+		cutoff: Cursor.isoDateTime(),
+		fetch: ({ pageCursor, cutoff }) => Effect.gen(function* () {
+			const cutoffDate = parseCutoff(String(cutoff));
+			const page = yield* client.get(repositoryPage(RepositoryObjectSchema), typeof pageCursor === "string" ? pageCursor : withParams(installationRepositoriesPath, { per_page: "100" }));
+			return {
+				rows: page.body.repositories.filter((repository) => repository.created_at.getTime() <= cutoffDate.getTime()).map(toRow$2),
+				nextPageCursor: Option.getOrUndefined(page.next),
+				hasMore: Option.isSome(page.next)
+			};
+		})
+	}),
+	changes: Fetch.changes({
+		cursor: Cursor.string(),
+		interval: changesInterval,
+		fetch: ({ cursor }) => readChanges(String(cursor), listRepositories(client, RepositoryObjectSchema), (repositories) => repositories.filter(({ repository, since }) => isSince(since, repository.updated_at)).map(({ repository }) => toRow$2(repository)))
+	}),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => Effect.gen(function* () {
+			const event = yield* decodeEvent(RepositoryEventSchema, payload);
+			if (Schema.is(RepositoryDeletedEventSchema)(event)) return [yield* deleteRow(event.repository.id)];
+			const { repository } = event;
+			const full = repository.topics !== void 0 ? repository : (yield* client.get(RepositoryObjectSchema, `/repos/${repository.full_name}`)).body;
+			return [toRow$2(full)];
+		})
+	}
+});
+//#endregion
+//#region src/schemas/workflow-jobs.ts
+const step = Schema.Struct({
+	number: Long.pipe(Schema.annotateKey({ description: "Step number." })),
+	name: Schema.String.pipe(Schema.annotateKey({ description: "Step name." })),
+	status: Schema.String.pipe(Schema.annotateKey({ description: "Status, such as queued, in_progress, or completed." })),
+	conclusion: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Result of a completed step." })),
+	started_at: Schema.optionalKey(Schema.NullOr(Timestamp)).pipe(Schema.annotateKey({ description: "Time the step started." })),
+	completed_at: Schema.optionalKey(Schema.NullOr(Timestamp)).pipe(Schema.annotateKey({ description: "Time the step completed." }))
+});
+const WorkflowJobSchema = Schema.Struct({
+	id: Long.pipe(Schema.annotateKey({ description: "Unique job ID." })),
+	version: readVersion("job"),
+	node_id: Schema.String.pipe(Schema.annotateKey({ description: "GraphQL node ID of the job." })),
+	repository_id: Long.pipe(Schema.annotateKey({ description: "ID of the repository the job belongs to." })),
+	run_id: Long.pipe(Schema.annotateKey({ description: "ID of the workflow run." })),
+	run_attempt: Schema.optionalKey(Long).pipe(Schema.annotateKey({ description: "Attempt of the run the job belongs to." })),
+	workflow_name: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Workflow name." })),
+	name: Schema.String.pipe(Schema.annotateKey({ description: "Job name." })),
+	head_sha: Schema.String.pipe(Schema.annotateKey({ description: "SHA of the commit the job ran on." })),
+	head_branch: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Branch the job ran on." })),
+	status: Schema.String.pipe(Schema.annotateKey({ description: "Status, such as queued, in_progress, or completed." })),
+	conclusion: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Result of a completed job, such as success or failure." })),
+	created_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the job was queued." })),
+	started_at: Timestamp.pipe(Schema.annotateKey({ description: "Time the job started." })),
+	completed_at: Schema.NullOr(Timestamp).pipe(Schema.annotateKey({ description: "Time the job completed." })),
+	runner_name: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Name of the runner." })),
+	labels: Schema.Array(Schema.String).pipe(Schema.annotateKey({ description: "Runner labels the job asked for." })),
+	steps: Schema.Array(step).pipe(Schema.annotateKey({ description: "Steps of the job." })),
+	html_url: Schema.NullOr(Schema.String).pipe(Schema.annotateKey({ description: "Job page on GitHub." }))
+}).annotate({ description: "Jobs of GitHub Actions workflow runs. Each run attempt has its own jobs." }).pipe(Iceberg.identifier("id"));
+const WorkflowJobObjectSchema = WorkflowJobSchema.mapFields((fields) => ({
+	...Struct.omit(fields, [
+		"version",
+		"repository_id",
+		"steps"
+	]),
+	steps: Schema.optionalKey(Schema.Array(step))
+}));
+//#endregion
+//#region src/resources/workflow-runs.ts
+const toRow$1 = ({ updated_at, pull_requests, ...rest }, repository_id) => ({
+	...rest,
+	version: updated_at,
+	repository_id,
+	pull_requests: pull_requests ?? []
+});
+const workflowRunSpec = {
+	path: "actions/runs",
+	pageSchema: wrappedList("workflow_runs", WorkflowRunObjectSchema),
+	params: {},
+	since: false,
+	order: "newest",
+	recentFor: Duration.days(1),
+	...timestamps,
+	keep: () => true,
+	enabled: () => true,
+	rows: rowsOf(toRow$1)
+};
+const makeWorkflowRuns = (client, repositories) => Resource.entity({
+	name: "workflow_runs",
+	rowSchema: WorkflowRunSchema,
+	version: "version",
+	check: checkRepoResource(client, workflowRunSpec),
+	backfill: backfillRepoResource(client, repositories, workflowRunSpec),
+	changes: changesRepoResource(client, workflowRunSpec),
+	webhook: {
+		schema: WebhookPayloadSchema,
+		handler: ({ payload }) => decodeEvent(WorkflowRunEventSchema, payload).pipe(Effect.map((event) => [toRow$1(event.workflow_run, event.repository.id)]))
+	}
+});
+//#endregion
+//#region src/resources/workflow-jobs.ts
+const toRow = ({ steps, ...rest }, repository_id, version) => ({
+	...rest,
+	version,
+	repository_id,
+	steps: steps ?? []
+});
+const workflowJobSpec = (client) => ({
+	...workflowRunSpec,
+	rows: childRows(client, {
+		path: (run) => `actions/runs/${run.id}/jobs`,
+		pageSchema: wrappedList("jobs", WorkflowJobObjectSchema),
+		params: { filter: "all" },
+		toRow: (job, _run, repositoryId, readAt) => toRow(job, repositoryId, readAt)
+	})
+});
+const makeWorkflowJobs = (client, repositories) => {
+	const spec = workflowJobSpec(client);
+	return Resource.entity({
+		name: "workflow_jobs",
+		rowSchema: WorkflowJobSchema,
+		version: "version",
+		check: checkRepoResource(client, spec),
+		backfill: backfillRepoResource(client, repositories, spec),
+		changes: changesRepoResource(client, spec),
+		webhook: {
+			schema: WebhookPayloadSchema,
+			handler: ({ payload }) => Effect.gen(function* () {
+				const { repository, workflow_job } = yield* decodeEvent(WorkflowJobEventSchema, payload);
+				const readAt = yield* DateTime.nowAsDate;
+				const page = yield* client.get(WorkflowJobObjectSchema, `/repos/${repository.full_name}/actions/jobs/${workflow_job.id}`);
+				return [toRow(page.body, repository.id, readAt)];
+			})
+		}
+	});
+};
+//#endregion
+//#region src/webhook/signature.ts
+const prefix = "sha256=";
+const verifySignature = (options) => {
+	const header = options.header ?? "";
+	const expected = createHmac("sha256", options.secret).update(options.rawBody).digest();
+	const provided = Buffer.from(header.slice(7), "hex");
+	return header.startsWith(prefix) && provided.length === expected.length && timingSafeEqual(provided, expected) ? Effect.void : Effect.fail(new ConnectorError({ message: "Invalid GitHub webhook signature" }));
+};
+//#endregion
+//#region src/webhook/route.ts
+const webhookPath = "/webhooks/github";
+const makeWebhookRoute = (options) => Webhook.route({
+	path: webhookPath,
+	ackMode: "after-enqueue",
+	schema: WebhookPayloadSchema,
+	handler: ({ request, rawBody, payload, to }) => Effect.gen(function* () {
+		const verified = yield* verifySignature({
+			rawBody,
+			header: request.headers["x-hub-signature-256"],
+			secret: options.secret
+		}).pipe(Effect.result);
+		if (Result.isFailure(verified)) return HttpServerResponse.jsonUnsafe({
+			ok: false,
+			error: verified.failure.message
+		}, { status: 401 });
+		const installationId = Schema.decodeUnknownOption(InstallationEventSchema)(payload).pipe(Option.flatMap(({ installation }) => Option.fromNullishOr(installation?.id)));
+		if (Option.contains(installationId, options.installationId)) {
+			const resources = options.targets.get(request.headers["x-github-event"] ?? "") ?? [];
+			yield* Effect.forEach(resources, (resource) => to(resource, payload), { discard: true });
+		}
+		return HttpServerResponse.jsonUnsafe({ ok: true });
+	})
+});
+//#endregion
+//#region src/connector.ts
+var connector_exports = /* @__PURE__ */ __exportAll({
+	GitHubConfigDef: () => GitHubConfigDef,
+	GitHubConnector: () => GitHubConnector,
+	layer: () => layer,
+	layerConfig: () => layerConfig,
+	make: () => make,
+	manifest: () => manifest
+});
+const make = Effect.fnUntraced(function* (config) {
+	const client = yield* GitHubClient;
+	const repositories = yield* cachedRepositoryRefs(client);
+	const Repositories = makeRepositories(client);
+	const Issues = makeIssues(client, repositories);
+	const PullRequests = makePullRequests(client, repositories);
+	const IssueComments = makeIssueComments(client, repositories);
+	const PullRequestReviews = makePullRequestReviews(client, repositories);
+	const PullRequestReviewComments = makePullRequestReviewComments(client, repositories);
+	const PullRequestCommits = makePullRequestCommits(client, repositories);
+	const Commits = makeCommits(client, repositories);
+	const CheckRuns = makeCheckRuns(client, repositories);
+	const CommitStatuses = makeCommitStatuses(client, repositories);
+	const WorkflowRuns = makeWorkflowRuns(client, repositories);
+	const WorkflowJobs = makeWorkflowJobs(client, repositories);
+	const Releases = makeReleases(client, repositories);
+	return Connector.define({
+		name: "producer-github",
+		title: "GitHub",
+		resources: [
+			Repositories,
+			Issues,
+			PullRequests,
+			IssueComments,
+			PullRequestReviews,
+			PullRequestReviewComments,
+			PullRequestCommits,
+			Commits,
+			CheckRuns,
+			CommitStatuses,
+			WorkflowRuns,
+			WorkflowJobs,
+			Releases
+		],
+		webhooks: [makeWebhookRoute({
+			secret: Redacted.value(config.webhookSecret),
+			installationId: config.installationId,
+			targets: /* @__PURE__ */ new Map([
+				["repository", [Repositories]],
+				["issues", [Issues]],
+				["pull_request", [PullRequests, PullRequestCommits]],
+				["issue_comment", [IssueComments]],
+				["pull_request_review", [PullRequestReviews]],
+				["pull_request_review_comment", [PullRequestReviewComments]],
+				["push", [Commits]],
+				["check_run", [CheckRuns]],
+				["status", [CommitStatuses]],
+				["workflow_run", [WorkflowRuns]],
+				["workflow_job", [WorkflowJobs]],
+				["release", [Releases]]
+			])
+		})]
+	});
+});
+var GitHubConnector = class extends Context.Service()("@useairfoil/producer-github/GitHubConnector") {};
+const layer = (config) => Layer.effect(GitHubConnector)(make(config).pipe(Effect.annotateLogs({ component: "github" }))).pipe(Layer.provide(layer$1(config)));
+const layerConfig = (config) => Layer.unwrap(Config.unwrap(config).pipe(Effect.map(layer)));
+//#endregion
+export { auth_exports as C, client_exports as S, IssueObjectSchema as _, WorkflowJobSchema as a, IssueCommentSchema as b, CommitStatusSchema as c, RepositoryObjectSchema as d, RepositorySchema as f, PullRequestReviewCommentSchema as g, PullRequestSchema as h, webhookPath as i, CommitSchema as l, PullRequestObjectSchema as m, connector_exports as n, PullRequestReviewSchema as o, ReleaseSchema as p, layerConfig as r, PullRequestCommitSchema as s, GitHubConnector as t, WorkflowRunSchema as u, IssueSchema as v, CheckRunSchema as x, IssueCommentObjectSchema as y };
+
+//# sourceMappingURL=src-DKDUc00e.mjs.map