@usine/github 0.0.0 → 0.1.0

package/dist/jwt.js

@@ -0,0 +1,72 @@
+import { Clock, Effect, Redacted } from "effect";
+import { AppAuthenticationError } from "./model.js";
+const encoder = new TextEncoder();
+const RSA_ALGORITHM_IDENTIFIER = new Uint8Array([
+    0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00,
+]);
+const concat = (...values) => {
+    const output = new Uint8Array(values.reduce((size, value) => size + value.length, 0));
+    let offset = 0;
+    for (const value of values) {
+        output.set(value, offset);
+        offset += value.length;
+    }
+    return output;
+};
+const derLength = (length) => {
+    if (length < 0x80)
+        return new Uint8Array([length]);
+    const bytes = [];
+    for (let remaining = length; remaining > 0; remaining >>>= 8)
+        bytes.unshift(remaining & 0xff);
+    return new Uint8Array([0x80 | bytes.length, ...bytes]);
+};
+const der = (tag, value) => concat(new Uint8Array([tag]), derLength(value.length), value);
+/** WebCrypto imports PKCS#8 only; GitHub downloads PKCS#1, so wrap it. */
+const wrapPkcs1AsPkcs8 = (pkcs1) => der(0x30, concat(new Uint8Array([0x02, 0x01, 0x00]), RSA_ALGORITHM_IDENTIFIER, der(0x04, pkcs1)));
+const decodePem = (pem) => {
+    const pkcs1 = pem.includes("-----BEGIN RSA PRIVATE KEY-----");
+    const base64 = pem
+        .replace(/-----BEGIN (?:RSA )?PRIVATE KEY-----/gu, "")
+        .replace(/-----END (?:RSA )?PRIVATE KEY-----/gu, "")
+        .replace(/\s/gu, "");
+    const binary = atob(base64);
+    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    return pkcs1 ? wrapPkcs1AsPkcs8(bytes) : bytes;
+};
+const base64Url = (value) => {
+    let binary = "";
+    for (const byte of value)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/=/gu, "").replace(/\+/gu, "-").replace(/\//gu, "_");
+};
+const encodeJson = (value) => base64Url(encoder.encode(JSON.stringify(value)));
+const toArrayBuffer = (value) => {
+    const buffer = new ArrayBuffer(value.byteLength);
+    new Uint8Array(buffer).set(value);
+    return buffer;
+};
+/**
+ * Import the App private key once (platform-free WebCrypto, RS256). A key
+ * that cannot be imported fails here, at composition, not on the first request.
+ */
+export const appJwtSigner = Effect.fn("AppJwt.import")(function* (credentials) {
+    const key = yield* Effect.tryPromise({
+        try: async () => crypto.subtle.importKey("pkcs8", toArrayBuffer(decodePem(Redacted.value(credentials.privateKey))), { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["sign"]),
+        catch: () => new AppAuthenticationError({
+            message: "The GitHub App private key is not an RSA private key WebCrypto can import",
+        }),
+    });
+    const sign = Effect.fn("AppJwt.sign")(function* () {
+        const now = Math.floor((yield* Clock.currentTimeMillis) / 1_000);
+        const unsigned = `${encodeJson({ alg: "RS256", typ: "JWT" })}.${encodeJson({
+            iat: now - 60,
+            exp: now + 9 * 60,
+            iss: credentials.appId,
+        })}`;
+        const signature = yield* Effect.promise(() => crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, toArrayBuffer(encoder.encode(unsigned))));
+        return Redacted.make(`${unsigned}.${base64Url(new Uint8Array(signature))}`);
+    });
+    return sign;
+});
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,YAAY,CAAC;AAazE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC;IAC9C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACzF,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,GAAG,MAAiC,EAAc,EAAE;IAClE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,MAAc,EAAc,EAAE;IAC/C,IAAI,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,IAAI,SAAS,GAAG,MAAM,EAAE,SAAS,GAAG,CAAC,EAAE,SAAS,MAAM,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC9F,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAiB,EAAc,EAAE,CACzD,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAEhE,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,CAAC,KAAiB,EAAc,EAAE,CACzD,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,wBAAwB,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAEpG,MAAM,SAAS,GAAG,CAAC,GAAW,EAAc,EAAE;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,wCAAwC,EAAE,EAAE,CAAC;SACrD,OAAO,CAAC,sCAAsC,EAAE,EAAE,CAAC;SACnD,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAA4B,EAAU,EAAE,CAC1D,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAe,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAKF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,EAAE,WAA2B;IAC3F,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,GAAG,EAAE,KAAK,IAAI,EAAE,CACd,MAAM,CAAC,MAAM,CAAC,SAAS,CACrB,OAAO,EACP,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAChE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT;QACH,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,sBAAsB,CAAC;YACzB,OAAO,EAAE,2EAA2E;SACrF,CAAC;KACL,CAAC,CAAC;IAEH,MAAM,IAAI,GAAiB,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,UAAU,CAAC;YACzE,GAAG,EAAE,GAAG,GAAG,EAAE;YACb,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE;YACjB,GAAG,EAAE,WAAW,CAAC,KAAK;SACvB,CAAC,EAAE,CAAC;QACL,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CACtF,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC"}

package/dist/local-secrets.d.ts

@@ -0,0 +1,28 @@
+import { Instance } from "@usine/core";
+import { Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { AppCredentials, GitHubCredentials } from "./model.ts";
+export declare const GITHUB_APP_SECRETS_PATH = ".usine/github-app.json";
+declare const EnvironmentCredentialsError_base: Schema.Class<EnvironmentCredentialsError, Schema.TaggedStruct<"EnvironmentCredentialsError", {
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+export declare class EnvironmentCredentialsError extends EnvironmentCredentialsError_base {
+}
+export declare const SecretsFileReason: Schema.Literals<readonly ["read", "permissions", "parse"]>;
+export type SecretsFileReason = typeof SecretsFileReason.Type;
+declare const SecretsFileError_base: Schema.Class<SecretsFileError, Schema.TaggedStruct<"SecretsFileError", {
+    readonly path: Schema.NonEmptyString;
+    readonly reason: Schema.Literals<readonly ["read", "permissions", "parse"]>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+export declare class SecretsFileError extends SecretsFileError_base {
+}
+export declare const LocalSecretsError: Schema.Union<readonly [typeof EnvironmentCredentialsError, typeof SecretsFileError]>;
+export type LocalSecretsError = typeof LocalSecretsError.Type;
+/**
+ * Load the orchestrator's App credentials. Each environment variable wins
+ * over its file field; when both are present the file is not touched.
+ */
+export declare const loadLocalCredentials: (root: string & import("effect/Brand").Brand<"InstanceDirectory">) => Effect.Effect<AppCredentials, EnvironmentCredentialsError | SecretsFileError, FileSystem.FileSystem | Path.Path>;
+export declare const localSecretsLayer: (root: Instance.Directory) => Layer.Layer<GitHubCredentials, LocalSecretsError, FileSystem.FileSystem | Path.Path>;
+export {};
+//# sourceMappingURL=local-secrets.d.ts.map

package/dist/local-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-secrets.d.ts","sourceRoot":"","sources":["../src/local-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAU,MAAM,EAAE,UAAU,EAAE,KAAK,EAAU,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjF,OAAO,EAAE,cAAc,EAAS,iBAAiB,EAAsB,MAAM,YAAY,CAAC;AAE1F,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;;;;AAEhE,qBAAa,2BAA4B,SAAQ,gCAI/C;CAAG;AAEL,eAAO,MAAM,iBAAiB,4DAAoD,CAAC;AACnF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;;;;;;AAE9D,qBAAa,gBAAiB,SAAQ,qBAMpC;CAAG;AAEL,eAAO,MAAM,iBAAiB,sFAAgE,CAAC;AAC/F,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAwC9D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,wLAoB/B,CAAC;AAEH,eAAO,MAAM,iBAAiB,SACtB,QAAQ,CAAC,SAAS,KACvB,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CACzB,CAAC"}

package/dist/local-secrets.js

@@ -0,0 +1,56 @@
+import { Instance } from "@usine/core";
+import { Config, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
+import { AppCredentials, AppId, GitHubCredentials, RedactedPrivateKey } from "./model.js";
+export const GITHUB_APP_SECRETS_PATH = ".usine/github-app.json";
+export class EnvironmentCredentialsError extends Schema.TaggedError("@usine/github/EnvironmentCredentialsError")("EnvironmentCredentialsError", {
+    message: Schema.NonEmptyString,
+}) {
+}
+export const SecretsFileReason = Schema.Literals(["read", "permissions", "parse"]);
+export class SecretsFileError extends Schema.TaggedError("@usine/github/SecretsFileError")("SecretsFileError", {
+    path: Schema.NonEmptyString,
+    reason: SecretsFileReason,
+    message: Schema.NonEmptyString,
+}) {
+}
+export const LocalSecretsError = Schema.Union([EnvironmentCredentialsError, SecretsFileError]);
+const AppIdFromString = Schema.FiniteFromString.pipe(Schema.decodeTo(AppId));
+/** Each variable is optional on its own; a present but invalid one is an error, never a fallback. */
+const environment = Config.all({
+    appId: Config.option(Config.schema(AppIdFromString, "USINE_GITHUB_APP_ID")),
+    privateKey: Config.option(Config.schema(RedactedPrivateKey, "USINE_GITHUB_PRIVATE_KEY")),
+});
+const AppCredentialsFile = Schema.fromJsonString(Schema.Struct({ appId: AppId, privateKey: RedactedPrivateKey }).pipe(Schema.encodeKeys({ appId: "app_id", privateKey: "private_key" })));
+const decodeCredentialsFile = Schema.decodeUnknownEffect(AppCredentialsFile);
+const readSecretsFile = Effect.fn("GitHubCredentials.readSecretsFile")(function* (root) {
+    const fileSystem = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const secretsPath = path.join(root, GITHUB_APP_SECRETS_PATH);
+    const fail = (reason, message) => new SecretsFileError({ path: secretsPath, reason, message });
+    const unreadable = () => fail("read", `Could not read GitHub App secrets at ${secretsPath}`);
+    const info = yield* fileSystem.stat(secretsPath).pipe(Effect.mapError(unreadable));
+    if (info.type !== "File" || (info.mode & 0o777) !== 0o600) {
+        return yield* fail("permissions", `GitHub App secrets must be a regular 0600 file: ${secretsPath}`);
+    }
+    const source = yield* fileSystem.readFileString(secretsPath).pipe(Effect.mapError(unreadable));
+    return yield* decodeCredentialsFile(source, { onExcessProperty: "error" }).pipe(Effect.mapError(() => fail("parse", `GitHub App secrets are invalid at ${secretsPath}`)));
+});
+/**
+ * Load the orchestrator's App credentials. Each environment variable wins
+ * over its file field; when both are present the file is not touched.
+ */
+export const loadLocalCredentials = Effect.fn("GitHubCredentials.loadLocal")(function* (root) {
+    const env = yield* environment.pipe(Effect.mapError(() => new EnvironmentCredentialsError({
+        message: "USINE_GITHUB_APP_ID and USINE_GITHUB_PRIVATE_KEY must contain valid GitHub App credentials",
+    })));
+    if (Option.isSome(env.appId) && Option.isSome(env.privateKey)) {
+        return new AppCredentials({ appId: env.appId.value, privateKey: env.privateKey.value });
+    }
+    const file = yield* readSecretsFile(root);
+    return new AppCredentials({
+        appId: Option.getOrElse(env.appId, () => file.appId),
+        privateKey: Option.getOrElse(env.privateKey, () => file.privateKey),
+    });
+});
+export const localSecretsLayer = (root) => Layer.effect(GitHubCredentials, loadLocalCredentials(root));
+//# sourceMappingURL=local-secrets.js.map

package/dist/local-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-secrets.js","sourceRoot":"","sources":["../src/local-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,MAAM,OAAO,2BAA4B,SAAQ,MAAM,CAAC,WAAW,CACjE,2CAA2C,CAC5C,CAAC,6BAA6B,EAAE;IAC/B,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnF,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,CACtD,gCAAgC,CACjC,CAAC,kBAAkB,EAAE;IACpB,IAAI,EAAE,MAAM,CAAC,cAAc;IAC3B,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAG/F,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAE7E,qGAAqG;AACrG,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;CACzF,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,MAAM,CAAC,cAAc,CAC9C,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAClE,CACF,CAAC;AACF,MAAM,qBAAqB,GAAG,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;AAE7E,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EAC9E,IAAwB;IAExB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAE,OAAe,EAAE,EAAE,CAC1D,IAAI,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,wCAAwC,WAAW,EAAE,CAAC,CAAC;IAE7F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,CAAC,IAAI,CAChB,aAAa,EACb,mDAAmD,WAAW,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAC7E,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,qCAAqC,WAAW,EAAE,CAAC,CAAC,CACzF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EACpF,IAAwB;IAExB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,2BAA2B,CAAC;QAC9B,OAAO,EACL,4FAA4F;KAC/F,CAAC,CACL,CACF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,cAAc,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QACpD,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;KACpE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,IAAwB,EAC8D,EAAE,CACxF,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/dist/model.d.ts

@@ -0,0 +1,128 @@
+import { Repository } from "@usine/core";
+import { Context, Schema } from "effect";
+export declare const AppId: Schema.brand<Schema.Int, "GitHubAppId">;
+export type AppId = typeof AppId.Type;
+export declare const InstallationId: Schema.brand<Schema.Int, "GitHubInstallationId">;
+export type InstallationId = typeof InstallationId.Type;
+export declare const RepositoryId: Schema.brand<Schema.Int, "GitHubRepositoryId">;
+export type RepositoryId = typeof RepositoryId.Type;
+export declare const PrivateKey: Schema.brand<Schema.NonEmptyString, "GitHubAppPrivateKey">;
+export type PrivateKey = typeof PrivateKey.Type;
+/** A PEM string parsed straight into a `Redacted` that can never be encoded back out. */
+export declare const RedactedPrivateKey: Schema.RedactedFromValue<Schema.brand<Schema.NonEmptyString, "GitHubAppPrivateKey">>;
+export declare const GitHubOperation: Schema.Literals<readonly ["discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+export type GitHubOperation = typeof GitHubOperation.Type;
+declare const AppCredentials_base: Schema.Class<AppCredentials, Schema.Struct<{
+    readonly appId: Schema.brand<Schema.Int, "GitHubAppId">;
+    readonly privateKey: Schema.RedactedFromValue<Schema.brand<Schema.NonEmptyString, "GitHubAppPrivateKey">>;
+}>, {}>;
+/** Credentials held by the orchestrator and never passed to a worker. */
+export declare class AppCredentials extends AppCredentials_base {
+}
+declare const GitHubCredentials_base: Context.ServiceClass<GitHubCredentials, "@usine/github/GitHubCredentials", AppCredentials>;
+/** Service boundary that keeps credential sourcing separate from App use. */
+export declare class GitHubCredentials extends GitHubCredentials_base {
+}
+export declare const REQUIRED_REPOSITORY_PERMISSIONS: {
+    readonly checks: "read";
+    readonly contents: "write";
+    readonly issues: "write";
+    readonly metadata: "read";
+    readonly pull_requests: "write";
+};
+export type RequiredRepositoryPermission = keyof typeof REQUIRED_REPOSITORY_PERMISSIONS;
+/** Pure deriver: the required permissions an installation's grant does not satisfy. */
+export declare const missingPermissions: (granted: Readonly<Record<string, string>>) => ReadonlyArray<string>;
+declare const Installation_base: Schema.Class<Installation, Schema.Struct<{
+    readonly id: Schema.brand<Schema.Int, "GitHubInstallationId">;
+    readonly accountLogin: Schema.NonEmptyString;
+}>, {}>;
+export declare class Installation extends Installation_base {
+}
+declare const InstallationWide_base: Schema.Class<InstallationWide, Schema.TaggedStruct<"InstallationWide", {}>, {}>;
+export declare class InstallationWide extends InstallationWide_base {
+}
+declare const SingleRepository_base: Schema.Class<SingleRepository, Schema.TaggedStruct<"SingleRepository", {
+    readonly repository: Schema.brand<Schema.String, "RepoName">;
+    readonly repositoryId: Schema.brand<Schema.Int, "GitHubRepositoryId">;
+}>, {}>;
+export declare class SingleRepository extends SingleRepository_base {
+}
+export declare const TokenScope: Schema.Union<readonly [typeof InstallationWide, typeof SingleRepository]>;
+export type TokenScope = typeof TokenScope.Type;
+declare const InstallationToken_base: Schema.Class<InstallationToken, Schema.Struct<{
+    readonly value: Schema.Redacted<Schema.NonEmptyString>;
+    readonly expiresAt: Schema.DateTimeUtc;
+    readonly scope: Schema.Union<readonly [typeof InstallationWide, typeof SingleRepository]>;
+}>, {}>;
+export declare class InstallationToken extends InstallationToken_base {
+}
+declare const CoveredProject_base: Schema.Class<CoveredProject, Schema.TaggedStruct<"CoveredProject", {
+    readonly installationId: Schema.brand<Schema.Int, "GitHubInstallationId">;
+    readonly repository: Schema.brand<Schema.String, "RepoName">;
+    readonly repositoryId: Schema.brand<Schema.Int, "GitHubRepositoryId">;
+}>, {}>;
+export declare class CoveredProject extends CoveredProject_base {
+}
+declare const ProjectNotInstalledError_base: Schema.Class<ProjectNotInstalledError, Schema.TaggedStruct<"ProjectNotInstalledError", {
+    readonly repository: Schema.brand<Schema.String, "RepoName">;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** Typed, project-local registry drift. It never fails covered siblings. */
+export declare class ProjectNotInstalledError extends ProjectNotInstalledError_base {
+}
+export declare const ProjectAccess: Schema.Union<readonly [typeof CoveredProject, typeof ProjectNotInstalledError]>;
+export type ProjectAccess = typeof ProjectAccess.Type;
+export interface InstalledRepository {
+    readonly id: RepositoryId;
+    readonly name: Repository.Name;
+}
+/** Pure registry⊆installation derivation: one result, and one error, per project. */
+export declare const deriveProjectAccess: (installation: Installation, registry: ReadonlyArray<Repository.Name>, installed: ReadonlyArray<InstalledRepository>) => ReadonlyArray<ProjectAccess>;
+declare const AppAuthenticationError_base: Schema.Class<AppAuthenticationError, Schema.TaggedStruct<"AppAuthenticationError", {
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** The private key cannot sign: raised once, when the App layer is built. */
+export declare class AppAuthenticationError extends AppAuthenticationError_base {
+}
+export declare const InstallationDiscoveryReason: Schema.Literals<readonly ["missing", "multiple", "suspended"]>;
+export type InstallationDiscoveryReason = typeof InstallationDiscoveryReason.Type;
+declare const InstallationDiscoveryError_base: Schema.Class<InstallationDiscoveryError, Schema.TaggedStruct<"InstallationDiscoveryError", {
+    readonly reason: Schema.Literals<readonly ["missing", "multiple", "suspended"]>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+export declare class InstallationDiscoveryError extends InstallationDiscoveryError_base {
+}
+declare const AppPermissionError_base: Schema.Class<AppPermissionError, Schema.TaggedStruct<"AppPermissionError", {
+    readonly missing: Schema.$Array<Schema.NonEmptyString>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+export declare class AppPermissionError extends AppPermissionError_base {
+}
+declare const GitHubApiError_base: Schema.Class<GitHubApiError, Schema.TaggedStruct<"GitHubApiError", {
+    readonly operation: Schema.Literals<readonly ["discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+    readonly status: Schema.Option<Schema.Int>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+export declare class GitHubApiError extends GitHubApiError_base {
+}
+declare const GitHubRateLimitError_base: Schema.Class<GitHubRateLimitError, Schema.TaggedStruct<"GitHubRateLimitError", {
+    readonly operation: Schema.Literals<readonly ["discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+    readonly retryAt: Schema.DateTimeUtc;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+export declare class GitHubRateLimitError extends GitHubRateLimitError_base {
+}
+declare const InvalidGitHubResponseError_base: Schema.Class<InvalidGitHubResponseError, Schema.TaggedStruct<"InvalidGitHubResponseError", {
+    readonly operation: Schema.Literals<readonly ["discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+    readonly message: Schema.NonEmptyString;
+    /** What made the response invalid — decode path, missing field, GraphQL errors. */
+    readonly detail: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+export declare class InvalidGitHubResponseError extends InvalidGitHubResponseError_base {
+}
+/** Everything one GitHub App call can fail with. */
+export declare const GitHubAppError: Schema.Union<readonly [typeof InstallationDiscoveryError, typeof AppPermissionError, typeof GitHubApiError, typeof GitHubRateLimitError, typeof InvalidGitHubResponseError]>;
+export type GitHubAppError = typeof GitHubAppError.Type;
+export {};
+//# sourceMappingURL=model.d.ts.map

package/dist/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIzC,eAAO,MAAM,KAAK,yCAAgD,CAAC;AACnE,MAAM,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC;AAEtC,eAAO,MAAM,cAAc,kDAAyD,CAAC;AACrF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC;AAExD,eAAO,MAAM,YAAY,gDAAuD,CAAC;AACjF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAEpD,eAAO,MAAM,UAAU,4DAKoB,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;AAEhD,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,sFAAiE,CAAC;AAEjG,eAAO,MAAM,eAAe,8RAW1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;;;;;AAE1D,yEAAyE;AACzE,qBAAa,cAAe,SAAQ,mBAGlC;CAAG;;AAEL,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;AAEJ,eAAO,MAAM,+BAA+B;aAC1C,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,OAAO;aACjB,MAAM,EAAE,OAAO;aACf,QAAQ,EAAE,MAAM;aAChB,aAAa,EAAE,OAAO;CACd,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAAG,MAAM,OAAO,+BAA+B,CAAC;AAKxF,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,YACpB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KACxC,aAAa,CAAC,MAAM,CAGpB,CAAC;;;;;AAEJ,qBAAa,YAAa,SAAQ,iBAGhC;CAAG;;AAEL,qBAAa,gBAAiB,SAAQ,qBAEb;CAAG;;;;;AAE5B,qBAAa,gBAAiB,SAAQ,qBAKpC;CAAG;AAEL,eAAO,MAAM,UAAU,2EAAqD,CAAC;AAC7E,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;;;;;AAEhD,qBAAa,iBAAkB,SAAQ,sBAMrC;CAAG;;;;;;AAEL,qBAAa,cAAe,SAAQ,mBAMlC;CAAG;;;;;AAEL,4EAA4E;AAC5E,qBAAa,wBAAyB,SAAQ,6BAK5C;CAAG;AAEL,eAAO,MAAM,aAAa,iFAA2D,CAAC;AACtF,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;CAChC;AAED,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,iBAChB,YAAY,YAChB,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,aAC7B,aAAa,CAAC,mBAAmB,CAAC,KAC5C,aAAa,CAAC,aAAa,CAe7B,CAAC;;;;AAEF,6EAA6E;AAC7E,qBAAa,sBAAuB,SAAQ,2BAI1C;CAAG;AAEL,eAAO,MAAM,2BAA2B,gEAAwD,CAAC;AACjG,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAC;;;;;AAElF,qBAAa,0BAA2B,SAAQ,+BAK9C;CAAG;;;;;AAEL,qBAAa,kBAAmB,SAAQ,uBAKtC;CAAG;;;;;;AAEL,qBAAa,cAAe,SAAQ,mBAMlC;CAAG;;;;;;AAEL,qBAAa,oBAAqB,SAAQ,yBAMxC;CAAG;;;;IAOH,mFAAmF;;;AALrF,qBAAa,0BAA2B,SAAQ,+BAO9C;CAAG;AAEL,oDAAoD;AACpD,eAAO,MAAM,cAAc,8KAMzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC"}

package/dist/model.js

@@ -0,0 +1,133 @@
+import { Repository } from "@usine/core";
+import { Context, Schema } from "effect";
+const PositiveInt = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));
+export const AppId = PositiveInt.pipe(Schema.brand("GitHubAppId"));
+export const InstallationId = PositiveInt.pipe(Schema.brand("GitHubInstallationId"));
+export const RepositoryId = PositiveInt.pipe(Schema.brand("GitHubRepositoryId"));
+export const PrivateKey = Schema.NonEmptyString.check(Schema.isPattern(/^-----BEGIN (?:RSA )?PRIVATE KEY-----[\s\S]+-----END (?:RSA )?PRIVATE KEY-----\s*$/u, { message: "Expected a PEM-encoded RSA private key" })).pipe(Schema.brand("GitHubAppPrivateKey"));
+/** A PEM string parsed straight into a `Redacted` that can never be encoded back out. */
+export const RedactedPrivateKey = Schema.RedactedFromValue(PrivateKey, { disallowEncode: true });
+export const GitHubOperation = Schema.Literals([
+    "discover-installation",
+    "fetch-item-labels",
+    "fetch-issue-snapshot",
+    "fetch-pull-request-snapshot",
+    "list-installation-repositories",
+    "list-repository-labels",
+    "mint-installation-token",
+    "mint-worker-token",
+    "poll-repository-changes",
+    "update-item-labels",
+]);
+/** Credentials held by the orchestrator and never passed to a worker. */
+export class AppCredentials extends Schema.Class("@usine/github/AppCredentials")({
+    appId: AppId,
+    privateKey: RedactedPrivateKey,
+}) {
+}
+/** Service boundary that keeps credential sourcing separate from App use. */
+export class GitHubCredentials extends Context.Service()("@usine/github/GitHubCredentials") {
+}
+export const REQUIRED_REPOSITORY_PERMISSIONS = {
+    checks: "read",
+    contents: "write",
+    issues: "write",
+    metadata: "read",
+    pull_requests: "write",
+};
+const grants = (actual, required) => actual === required || (required === "read" && actual === "write");
+/** Pure deriver: the required permissions an installation's grant does not satisfy. */
+export const missingPermissions = (granted) => Object.entries(REQUIRED_REPOSITORY_PERMISSIONS).flatMap(([permission, required]) => grants(granted[permission], required) ? [] : [`${permission}:${required}`]);
+export class Installation extends Schema.Class("@usine/github/Installation")({
+    id: InstallationId,
+    accountLogin: Schema.NonEmptyString,
+}) {
+}
+export class InstallationWide extends Schema.TaggedClass("@usine/github/TokenScope/InstallationWide")("InstallationWide", {}) {
+}
+export class SingleRepository extends Schema.TaggedClass("@usine/github/TokenScope/SingleRepository")("SingleRepository", {
+    repository: Repository.Name,
+    repositoryId: RepositoryId,
+}) {
+}
+export const TokenScope = Schema.Union([InstallationWide, SingleRepository]);
+export class InstallationToken extends Schema.Class("@usine/github/InstallationToken")({
+    value: Schema.Redacted(Schema.NonEmptyString, { disallowJsonEncode: true }),
+    expiresAt: Schema.DateTimeUtc,
+    scope: TokenScope,
+}) {
+}
+export class CoveredProject extends Schema.TaggedClass("@usine/github/ProjectAccess/CoveredProject")("CoveredProject", {
+    installationId: InstallationId,
+    repository: Repository.Name,
+    repositoryId: RepositoryId,
+}) {
+}
+/** Typed, project-local registry drift. It never fails covered siblings. */
+export class ProjectNotInstalledError extends Schema.TaggedError("@usine/github/ProjectNotInstalledError")("ProjectNotInstalledError", {
+    repository: Repository.Name,
+    message: Schema.NonEmptyString,
+}) {
+}
+export const ProjectAccess = Schema.Union([CoveredProject, ProjectNotInstalledError]);
+/** Pure registry⊆installation derivation: one result, and one error, per project. */
+export const deriveProjectAccess = (installation, registry, installed) => {
+    const byName = new Map(installed.map((repo) => [repo.name.toLowerCase(), repo]));
+    return registry.map((repository) => {
+        const match = byName.get(repository.toLowerCase());
+        return match === undefined
+            ? new ProjectNotInstalledError({
+                repository,
+                message: `The GitHub App installation does not cover ${repository}`,
+            })
+            : new CoveredProject({
+                installationId: installation.id,
+                repository,
+                repositoryId: match.id,
+            });
+    });
+};
+/** The private key cannot sign: raised once, when the App layer is built. */
+export class AppAuthenticationError extends Schema.TaggedError("@usine/github/AppAuthenticationError")("AppAuthenticationError", {
+    message: Schema.NonEmptyString,
+}) {
+}
+export const InstallationDiscoveryReason = Schema.Literals(["missing", "multiple", "suspended"]);
+export class InstallationDiscoveryError extends Schema.TaggedError("@usine/github/InstallationDiscoveryError")("InstallationDiscoveryError", {
+    reason: InstallationDiscoveryReason,
+    message: Schema.NonEmptyString,
+}) {
+}
+export class AppPermissionError extends Schema.TaggedError("@usine/github/AppPermissionError")("AppPermissionError", {
+    missing: Schema.Array(Schema.NonEmptyString).check(Schema.isNonEmpty()),
+    message: Schema.NonEmptyString,
+}) {
+}
+export class GitHubApiError extends Schema.TaggedError("@usine/github/GitHubApiError")("GitHubApiError", {
+    operation: GitHubOperation,
+    status: Schema.Option(Schema.Int),
+    message: Schema.NonEmptyString,
+}) {
+}
+export class GitHubRateLimitError extends Schema.TaggedError("@usine/github/GitHubRateLimitError")("GitHubRateLimitError", {
+    operation: GitHubOperation,
+    retryAt: Schema.DateTimeUtc,
+    message: Schema.NonEmptyString,
+}) {
+}
+export class InvalidGitHubResponseError extends Schema.TaggedError("@usine/github/InvalidGitHubResponseError")("InvalidGitHubResponseError", {
+    operation: GitHubOperation,
+    message: Schema.NonEmptyString,
+    /** What made the response invalid — decode path, missing field, GraphQL errors. */
+    detail: Schema.NonEmptyString,
+}) {
+}
+/** Everything one GitHub App call can fail with. */
+export const GitHubAppError = Schema.Union([
+    InstallationDiscoveryError,
+    AppPermissionError,
+    GitHubApiError,
+    GitHubRateLimitError,
+    InvalidGitHubResponseError,
+]);
+//# sourceMappingURL=model.js.map

package/dist/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEzC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAGnE,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAGrF,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAGjF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CACnD,MAAM,CAAC,SAAS,CACd,qFAAqF,EACrF,EAAE,OAAO,EAAE,wCAAwC,EAAE,CACtD,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAG5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;AAEjG,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7C,uBAAuB;IACvB,mBAAmB;IACnB,sBAAsB;IACtB,6BAA6B;IAC7B,gCAAgC;IAChC,wBAAwB;IACxB,yBAAyB;IACzB,mBAAmB;IACnB,yBAAyB;IACzB,oBAAoB;CACrB,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,KAAK,CAAiB,8BAA8B,CAAC,CAAC;IAC/F,KAAK,EAAE,KAAK;IACZ,UAAU,EAAE,kBAAkB;CAC/B,CAAC;CAAG;AAEL,6EAA6E;AAC7E,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAAqC,CACzF,iCAAiC,CAClC;CAAG;AAEJ,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,OAAO;CACd,CAAC;AAIX,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAE,QAA0B,EAAW,EAAE,CACjF,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;AAErE,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAyC,EAClB,EAAE,CACzB,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACjF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAC3E,CAAC;AAEJ,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,4BAA4B,CAAC,CAAC;IACzF,EAAE,EAAE,cAAc;IAClB,YAAY,EAAE,MAAM,CAAC,cAAc;CACpC,CAAC;CAAG;AAEL,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,CACtD,2CAA2C,CAC5C,CAAC,kBAAkB,EAAE,EAAE,CAAC;CAAG;AAE5B,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,CACtD,2CAA2C,CAC5C,CAAC,kBAAkB,EAAE;IACpB,UAAU,EAAE,UAAU,CAAC,IAAI;IAC3B,YAAY,EAAE,YAAY;CAC3B,CAAC;CAAG;AAEL,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAG7E,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,KAAK,CACjD,iCAAiC,CAClC,CAAC;IACA,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC3E,SAAS,EAAE,MAAM,CAAC,WAAW;IAC7B,KAAK,EAAE,UAAU;CAClB,CAAC;CAAG;AAEL,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,CACpD,4CAA4C,CAC7C,CAAC,gBAAgB,EAAE;IAClB,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU,CAAC,IAAI;IAC3B,YAAY,EAAE,YAAY;CAC3B,CAAC;CAAG;AAEL,4EAA4E;AAC5E,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,WAAW,CAC9D,wCAAwC,CACzC,CAAC,0BAA0B,EAAE;IAC5B,UAAU,EAAE,UAAU,CAAC,IAAI;IAC3B,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAQtF,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,YAA0B,EAC1B,QAAwC,EACxC,SAA6C,EACf,EAAE;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,IAAI,wBAAwB,CAAC;gBAC3B,UAAU;gBACV,OAAO,EAAE,8CAA8C,UAAU,EAAE;aACpE,CAAC;YACJ,CAAC,CAAC,IAAI,cAAc,CAAC;gBACjB,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,UAAU;gBACV,YAAY,EAAE,KAAK,CAAC,EAAE;aACvB,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,CAC5D,sCAAsC,CACvC,CAAC,wBAAwB,EAAE;IAC1B,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAGjG,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,CAChE,0CAA0C,CAC3C,CAAC,4BAA4B,EAAE;IAC9B,MAAM,EAAE,2BAA2B;IACnC,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,CACxD,kCAAkC,CACnC,CAAC,oBAAoB,EAAE;IACtB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACvE,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,CACpD,8BAA8B,CAC/B,CAAC,gBAAgB,EAAE;IAClB,SAAS,EAAE,eAAe;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,CAC1D,oCAAoC,CACrC,CAAC,sBAAsB,EAAE;IACxB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,MAAM,CAAC,WAAW;IAC3B,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,CAChE,0CAA0C,CAC3C,CAAC,4BAA4B,EAAE;IAC9B,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,MAAM,CAAC,cAAc;IAC9B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC,cAAc;CAC9B,CAAC;CAAG;AAEL,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC;IACzC,0BAA0B;IAC1B,kBAAkB;IAClB,cAAc;IACd,oBAAoB;IACpB,0BAA0B;CAC3B,CAAC,CAAC"}