@usine/github 0.0.1 → 0.1.1

package/README.md

@@ -1,5 +1,120 @@
 # @usine/github
 
-GitHub integration for usine: polling change detection, per-stream GraphQL slice fetchers, App auth and token minting.
+`@usine/github` gives an usine factory one GitHub App identity. It signs App JWTs, finds the App's installation, reports registry repositories that the installation does not cover, and mints two kinds of installation token:
 
-Part of [usine](https://github.com/basaltbytes/usine), an agent-agnostic software factory. This block is not implemented yet — its 0.0.x releases reserve the seam while the engine grows. Everything here is 0.x: APIs change without notice.
+- an installation-wide token for orchestrator polling and writes;
+- a token restricted to one repository for a worker attempt.
+
+Both token requests use a one-hour maximum lifetime. Expiry validation tolerates up to three minutes of clock skew while capping the local lease at one hour; expired tokens are rejected. Token values and the App private key stay inside Effect `Redacted` values.
+
+Import `GitHubApp`, credentials, access results, and typed App errors from `@usine/github/github-app`. `@usine/github/polling` provides `GitHubPolling` with its cursors, change-detection results, and payload snapshots. Item and label writes use `/item-writer` and `/label-writer`; local credential loading uses `/local-secrets`.
+
+`/polling` also exports `RepositoryLabel`, `RepositoryLabelCatalog`, and
+`RepositoryLabelsNotModified` for reading label catalogs and handling conditional
+responses. These contracts share the same entry point as `GitHubPolling`.
+
+## Create the App manually
+
+Open your GitHub account or organization settings, select **Developer settings → GitHub Apps**, then select **New GitHub App**. Use a name that identifies the factory and set **Where can this GitHub App be installed?** to **Only on this account**. User authorization isn't required. You can turn off active webhooks for a polling-only development factory.
+
+Set these repository permissions:
+
+| Permission | Access |
+| --- | --- |
+| Metadata | Read-only |
+| Contents | Read and write |
+| Issues | Read and write |
+| Pull requests | Read and write |
+| Checks | Read-only |
+
+Leave Workflows, Administration, every organization permission, and every account permission at **No access**. GitHub grants Metadata read access automatically. The Contents permission lets installation tokens authenticate Git over HTTPS; Workflows remains off, so worker tokens cannot edit files under `.github/workflows/`.
+
+Create the App, generate a private key, and note the numeric App ID. On the App's **Install App** page, install it on the account that owns the factory's managed repositories. Select every repository listed in `usine.yaml`. A factory expects one App installation, so don't install the same App on a second account.
+
+GitHub's current setup references are [Registering a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app) and [Choosing permissions for a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app).
+
+## Store the credentials
+
+The local runtime file is `<instance>/.usine/github-app.json`. Keep `.usine/` in the instance repo's `.gitignore`, and set the file mode to `0600`.
+
+```json
+{
+  "app_id": 123456,
+  "private_key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----\n"
+}
+```
+
+This command creates the JSON without copying PEM newlines by hand:
+
+```sh
+mkdir -p .usine
+install -m 600 /dev/null .usine/github-app.json
+jq -n --argjson app_id "$APP_ID" --rawfile private_key factory.private-key.pem \
+  '{app_id: $app_id, private_key: $private_key}' > .usine/github-app.json
+```
+
+`USINE_GITHUB_APP_ID` and `USINE_GITHUB_PRIVATE_KEY` override their matching file fields. When both variables exist, the loader does not read the file.
+
+## Compose the services
+
+The package root has no Node dependency. Supply an HTTP client plus platform file and path layers at the application edge:
+
+```ts
+import { NodeFileSystem, NodePath } from "@effect/platform-node"
+import { InstanceDirectory } from "@usine/core/instance"
+import { GitHubApp } from "@usine/github/github-app"
+import { localSecretsLayer } from "@usine/github/local-secrets"
+import { Layer } from "effect"
+import { FetchHttpClient } from "effect/unstable/http"
+
+const instance = InstanceDirectory.make("/path/to/instance")
+const platformLayer = Layer.merge(NodeFileSystem.layer, NodePath.layer)
+const credentialsLayer = localSecretsLayer(instance).pipe(
+  Layer.provide(platformLayer),
+)
+
+export const githubLayer = GitHubApp.layer.pipe(
+  Layer.provide(credentialsLayer),
+  Layer.provide(FetchHttpClient.layer),
+)
+```
+
+`GitHubApp.layer` imports the private key once, when the layer is built: a key WebCrypto cannot import fails composition with `AppAuthenticationError` instead of failing the first request. Another credential source provides `GitHubCredentials` with an `AppCredentials` whose key went through the `RedactedPrivateKey` schema.
+
+`installation()`, `installationToken()`, and `projectAccess()` share one lease: a single installation discovery and installation-wide mint, reused until five minutes before the token expires. Polling therefore costs no App requests between renewals. `workerToken()` mints on every call, so each attempt gets its own token.
+
+Call `GitHubApp.projectAccess(registry)` before scheduling work. Each result is either a `CoveredProject`, which carries the repository ID needed for scoped minting, or a `ProjectNotInstalledError`. A missing repository does not block covered projects.
+
+Pass a `CoveredProject` to `GitHubApp.workerToken`. GitHub must confirm in the token response that the token covers exactly that repository ID; otherwise the call fails with `InvalidGitHubResponseError`.
+
+## Poll repository changes
+
+`GitHubPollingLayer` supplies the operations the orchestrator needs:
+
+- `changes(repository, cursor)` makes one conditional Issues REST request. It returns changed issue and pull-request numbers, the next ETag and watermark, plus any rate-limit delay GitHub requested.
+- `labels(repository)` reads every page of the repository label catalog for Board lane proposals.
+
+Change-detection results distinguish `nextPollAt`, the earliest next conditional poll, from `backoffUntil`, a request delay caused by `Retry-After` or rate-limit pressure. Self-write Hints can fetch an Item snapshot during the normal poll interval while respecting request backoff.
+- `snapshot(repository, item)` fetches the issue or pull-request payload through GraphQL and computes its SHA-256 content hash. The stored payload retains timestamps, while the hash excludes timestamp fields at every nesting level.
+
+The REST cursor overlaps its watermark by five seconds. Repeated items are expected; the engine's permanent Event ledger owns deduplication. Provide `GitHubPollingLayer` with `GitHubApp`, an Effect HTTP client, and `Crypto.Crypto`. The package root remains platform-free.
+
+`GitHubItemWriter.updateLabels(repository, item, mutation)` adds destination lane labels and removes only explicitly lane-owned labels from an issue or pull request. It never replaces the complete applied-label set or deletes repository label definitions, so unrelated and concurrently added labels survive stale or truncated Item projections. The service requires `GitHubApp` and an Effect HTTP client.
+
+`GitHubLabelWriter.create(repository, label)` creates one repository label through `POST /repos/{owner}/{repo}/labels` using the installation-wide App token. Provide a name; color and description are optional. Reconciliation policy belongs to the orchestrator, so this service exposes creation only and never edits or deletes label definitions.
+
+## Real-App integration check
+
+Run the opt-in integration test against a disposable issue in a repository covered by the App:
+
+```sh
+export USINE_GITHUB_INTEGRATION_INSTANCE_DIRECTORY=/path/to/instance
+export USINE_GITHUB_INTEGRATION_REPO=owner/repo
+export USINE_GITHUB_INTEGRATION_ISSUE_NUMBER=123
+export 'USINE_GITHUB_INTEGRATION_BOT_LOGIN=your-app-slug[bot]'
+pnpm --filter @usine/github test:integration
+```
+
+The test mints both token shapes, posts one issue comment with the repository-scoped token, checks the comment author against the expected `<app>[bot]` login, and deletes the comment during cleanup. `@usine/orchestrator` has a separate live polling test that temporarily creates and applies a repository label.
+
+All APIs remain 0.x and can change between minor releases.

package/dist/access.d.ts

@@ -0,0 +1,48 @@
+import { RepositoryName } from "@usine/core/repository";
+import { Schema } from "effect";
+import { RepositoryId, Installation } from "./installation.ts";
+/** Repository grants required for polling, label updates, and agent-authored changes. */
+export declare const REQUIRED_REPOSITORY_PERMISSIONS: {
+    readonly checks: "read";
+    readonly contents: "write";
+    readonly issues: "write";
+    readonly metadata: "read";
+    readonly pull_requests: "write";
+};
+export type RequiredRepositoryPermission = keyof typeof REQUIRED_REPOSITORY_PERMISSIONS;
+/** The required repository permissions an installation grant does not satisfy, as `name:level` strings. */
+export declare const missingPermissions: (granted: Readonly<Record<string, string>>) => ReadonlyArray<string>;
+declare const CoveredProject_base: Schema.Class<CoveredProject, Schema.TaggedStruct<"CoveredProject", {
+    readonly installationId: Schema.brand<Schema.Int, "GitHubInstallationId">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    readonly repositoryId: Schema.brand<Schema.Int, "GitHubRepositoryId">;
+}>, {}>;
+/** A registered repository covered by the discovered GitHub App installation. */
+export declare class CoveredProject extends CoveredProject_base {
+}
+declare const ProjectNotInstalledError_base: Schema.Class<ProjectNotInstalledError, Schema.TaggedStruct<"ProjectNotInstalledError", {
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** A registry repository the installation does not cover. Raised per project, so covered siblings still load. */
+export declare class ProjectNotInstalledError extends ProjectNotInstalledError_base {
+}
+/** The installation coverage result for one registered repository. */
+export declare const ProjectAccess: Schema.Union<readonly [typeof CoveredProject, typeof ProjectNotInstalledError]>;
+export type ProjectAccess = typeof ProjectAccess.Type;
+/** A repository reported by GitHub for an installation, identified by its numeric id and full name. */
+export interface InstalledRepository {
+    readonly id: RepositoryId;
+    readonly name: RepositoryName;
+}
+/** Checks each registry repository against the installation's repositories and returns one `ProjectAccess` per project. */
+export declare const deriveProjectAccess: (installation: Installation, registry: ReadonlyArray<RepositoryName>, installed: ReadonlyArray<InstalledRepository>) => ReadonlyArray<ProjectAccess>;
+declare const AppPermissionError_base: Schema.Class<AppPermissionError, Schema.TaggedStruct<"AppPermissionError", {
+    readonly missing: Schema.$Array<Schema.NonEmptyString>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** The installation lacks required repository grants; missing entries use name:level form. */
+export declare class AppPermissionError extends AppPermissionError_base {
+}
+export {};
+//# sourceMappingURL=access.d.ts.map

package/dist/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAkB,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE/E,yFAAyF;AACzF,eAAO,MAAM,+BAA+B;aAC1C,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,OAAO;aACjB,MAAM,EAAE,OAAO;aACf,QAAQ,EAAE,MAAM;aAChB,aAAa,EAAE,OAAO;CACd,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAAG,MAAM,OAAO,+BAA+B,CAAC;AAKxF,2GAA2G;AAC3G,eAAO,MAAM,kBAAkB,YACpB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KACxC,aAAa,CAAC,MAAM,CAGpB,CAAC;;;;;;AAEJ,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,mBAMlC;CAAG;;;;;AAEL,iHAAiH;AACjH,qBAAa,wBAAyB,SAAQ,6BAK5C;CAAG;AAEL,sEAAsE;AACtE,eAAO,MAAM,aAAa,iFAA2D,CAAC;AACtF,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,uGAAuG;AACvG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED,2HAA2H;AAC3H,eAAO,MAAM,mBAAmB,iBAChB,YAAY,YAChB,aAAa,CAAC,cAAc,CAAC,aAC5B,aAAa,CAAC,mBAAmB,CAAC,KAC5C,aAAa,CAAC,aAAa,CAe7B,CAAC;;;;;AAEF,8FAA8F;AAC9F,qBAAa,kBAAmB,SAAQ,uBAKtC;CAAG"}

package/dist/access.js

@@ -0,0 +1,53 @@
+import { RepositoryName } from "@usine/core/repository";
+import { Schema } from "effect";
+import { InstallationId, RepositoryId, Installation } from "./installation.js";
+/** Repository grants required for polling, label updates, and agent-authored changes. */
+export const REQUIRED_REPOSITORY_PERMISSIONS = {
+    checks: "read",
+    contents: "write",
+    issues: "write",
+    metadata: "read",
+    pull_requests: "write",
+};
+const grants = (actual, required) => actual === required || (required === "read" && actual === "write");
+/** The required repository permissions an installation grant does not satisfy, as `name:level` strings. */
+export const missingPermissions = (granted) => Object.entries(REQUIRED_REPOSITORY_PERMISSIONS).flatMap(([permission, required]) => grants(granted[permission], required) ? [] : [`${permission}:${required}`]);
+/** A registered repository covered by the discovered GitHub App installation. */
+export class CoveredProject extends Schema.TaggedClass("@usine/github/ProjectAccess/CoveredProject")("CoveredProject", {
+    installationId: InstallationId,
+    repository: RepositoryName,
+    repositoryId: RepositoryId,
+}) {
+}
+/** A registry repository the installation does not cover. Raised per project, so covered siblings still load. */
+export class ProjectNotInstalledError extends Schema.TaggedError("@usine/github/ProjectNotInstalledError")("ProjectNotInstalledError", {
+    repository: RepositoryName,
+    message: Schema.NonEmptyString,
+}) {
+}
+/** The installation coverage result for one registered repository. */
+export const ProjectAccess = Schema.Union([CoveredProject, ProjectNotInstalledError]);
+/** Checks each registry repository against the installation's repositories and returns one `ProjectAccess` per project. */
+export const deriveProjectAccess = (installation, registry, installed) => {
+    const byName = new Map(installed.map((repo) => [repo.name.toLowerCase(), repo]));
+    return registry.map((repository) => {
+        const match = byName.get(repository.toLowerCase());
+        return match === undefined
+            ? new ProjectNotInstalledError({
+                repository,
+                message: `The GitHub App installation does not cover ${repository}`,
+            })
+            : new CoveredProject({
+                installationId: installation.id,
+                repository,
+                repositoryId: match.id,
+            });
+    });
+};
+/** The installation lacks required repository grants; missing entries use name:level form. */
+export class AppPermissionError extends Schema.TaggedError("@usine/github/AppPermissionError")("AppPermissionError", {
+    missing: Schema.Array(Schema.NonEmptyString).check(Schema.isNonEmpty()),
+    message: Schema.NonEmptyString,
+}) {
+}
+//# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE/E,yFAAyF;AACzF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,OAAO;CACd,CAAC;AAIX,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAE,QAA0B,EAAW,EAAE,CACjF,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;AAErE,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAyC,EAClB,EAAE,CACzB,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACjF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAC3E,CAAC;AAEJ,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,CACpD,4CAA4C,CAC7C,CAAC,gBAAgB,EAAE;IAClB,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,YAAY;CAC3B,CAAC;CAAG;AAEL,iHAAiH;AACjH,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,WAAW,CAC9D,wCAAwC,CACzC,CAAC,0BAA0B,EAAE;IAC5B,UAAU,EAAE,cAAc;IAC1B,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAStF,2HAA2H;AAC3H,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,YAA0B,EAC1B,QAAuC,EACvC,SAA6C,EACf,EAAE;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,IAAI,wBAAwB,CAAC;gBAC3B,UAAU;gBACV,OAAO,EAAE,8CAA8C,UAAU,EAAE;aACpE,CAAC;YACJ,CAAC,CAAC,IAAI,cAAc,CAAC;gBACjB,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,UAAU;gBACV,YAAY,EAAE,KAAK,CAAC,EAAE;aACvB,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,CACxD,kCAAkC,CACnC,CAAC,oBAAoB,EAAE;IACtB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACvE,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG"}

package/dist/credentials.d.ts

@@ -0,0 +1,28 @@
+import { Context, Schema } from "effect";
+/** The numeric GitHub App identity included in signed App JWTs. */
+export declare const AppId: Schema.brand<Schema.Int, "GitHubAppId">;
+export type AppId = typeof AppId.Type;
+/** A PEM-encoded RSA private key used to authenticate the GitHub App. */
+export declare const PrivateKey: Schema.brand<Schema.NonEmptyString, "GitHubAppPrivateKey">;
+export type PrivateKey = typeof PrivateKey.Type;
+/** An App signing key that stays redacted in diagnostics and cannot be encoded. */
+export declare const RedactedPrivateKey: Schema.RedactedFromValue<Schema.brand<Schema.NonEmptyString, "GitHubAppPrivateKey">>;
+declare const AppCredentials_base: Schema.Class<AppCredentials, Schema.Struct<{
+    readonly appId: Schema.brand<Schema.Int, "GitHubAppId">;
+    readonly privateKey: Schema.RedactedFromValue<Schema.brand<Schema.NonEmptyString, "GitHubAppPrivateKey">>;
+}>, {}>;
+/** The App credentials the orchestrator keeps and never passes to a worker. */
+export declare class AppCredentials extends AppCredentials_base {
+}
+declare const GitHubCredentials_base: Context.ServiceClass<GitHubCredentials, "@usine/github/GitHubCredentials", AppCredentials>;
+/** Supplies `AppCredentials`, so where credentials come from stays separate from how the App uses them. */
+export declare class GitHubCredentials extends GitHubCredentials_base {
+}
+declare const AppAuthenticationError_base: Schema.Class<AppAuthenticationError, Schema.TaggedStruct<"AppAuthenticationError", {
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** The App private key cannot sign. Raised once, when the App layer is built. */
+export declare class AppAuthenticationError extends AppAuthenticationError_base {
+}
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEzC,mEAAmE;AACnE,eAAO,MAAM,KAAK,yCAEjB,CAAC;AACF,MAAM,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC;AAEtC,yEAAyE;AACzE,eAAO,MAAM,UAAU,4DAKoB,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;AAEhD,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,sFAAiE,CAAC;;;;;AAEjG,+EAA+E;AAC/E,qBAAa,cAAe,SAAQ,mBAGlC;CAAG;;AAEL,2GAA2G;AAC3G,qBAAa,iBAAkB,SAAQ,sBAEtC;CAAG;;;;AAEJ,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,2BAI1C;CAAG"}

package/dist/credentials.js

@@ -0,0 +1,22 @@
+import { Context, Schema } from "effect";
+/** The numeric GitHub App identity included in signed App JWTs. */
+export const AppId = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)).pipe(Schema.brand("GitHubAppId"));
+/** A PEM-encoded RSA private key used to authenticate the GitHub App. */
+export const PrivateKey = Schema.NonEmptyString.check(Schema.isPattern(/^-----BEGIN (?:RSA )?PRIVATE KEY-----[\s\S]+-----END (?:RSA )?PRIVATE KEY-----\s*$/u, { message: "Expected a PEM-encoded RSA private key" })).pipe(Schema.brand("GitHubAppPrivateKey"));
+/** An App signing key that stays redacted in diagnostics and cannot be encoded. */
+export const RedactedPrivateKey = Schema.RedactedFromValue(PrivateKey, { disallowEncode: true });
+/** The App credentials the orchestrator keeps and never passes to a worker. */
+export class AppCredentials extends Schema.Class("@usine/github/AppCredentials")({
+    appId: AppId,
+    privateKey: RedactedPrivateKey,
+}) {
+}
+/** Supplies `AppCredentials`, so where credentials come from stays separate from how the App uses them. */
+export class GitHubCredentials extends Context.Service()("@usine/github/GitHubCredentials") {
+}
+/** The App private key cannot sign. Raised once, when the App layer is built. */
+export class AppAuthenticationError extends Schema.TaggedError("@usine/github/AppAuthenticationError")("AppAuthenticationError", {
+    message: Schema.NonEmptyString,
+}) {
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1E,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAC5B,CAAC;AAGF,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CACnD,MAAM,CAAC,SAAS,CACd,qFAAqF,EACrF,EAAE,OAAO,EAAE,wCAAwC,EAAE,CACtD,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAG5C,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;AAEjG,+EAA+E;AAC/E,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,KAAK,CAAiB,8BAA8B,CAAC,CAAC;IAC/F,KAAK,EAAE,KAAK;IACZ,UAAU,EAAE,kBAAkB;CAC/B,CAAC;CAAG;AAEL,2GAA2G;AAC3G,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAAqC,CACzF,iCAAiC,CAClC;CAAG;AAEJ,iFAAiF;AACjF,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,CAC5D,sCAAsC,CACvC,CAAC,wBAAwB,EAAE;IAC1B,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG"}

package/dist/error.d.ts

@@ -0,0 +1,36 @@
+import { Schema } from "effect";
+import { InstallationDiscoveryError } from "./installation.ts";
+import { AppPermissionError } from "./access.ts";
+/** The GitHub request that failed, shared by API, rate-limit, and response errors. */
+export declare const GitHubOperation: Schema.Literals<readonly ["create-repository-label", "discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+export type GitHubOperation = typeof GitHubOperation.Type;
+declare const GitHubApiError_base: Schema.Class<GitHubApiError, Schema.TaggedStruct<"GitHubApiError", {
+    readonly operation: Schema.Literals<readonly ["create-repository-label", "discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+    readonly status: Schema.Option<Schema.Int>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** A failed GitHub request, with an HTTP status when a response was received. */
+export declare class GitHubApiError extends GitHubApiError_base {
+}
+declare const GitHubRateLimitError_base: Schema.Class<GitHubRateLimitError, Schema.TaggedStruct<"GitHubRateLimitError", {
+    readonly operation: Schema.Literals<readonly ["create-repository-label", "discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+    readonly retryAt: Schema.DateTimeUtc;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** GitHub deferred the request until retryAt; callers can schedule a later attempt. */
+export declare class GitHubRateLimitError extends GitHubRateLimitError_base {
+}
+declare const InvalidGitHubResponseError_base: Schema.Class<InvalidGitHubResponseError, Schema.TaggedStruct<"InvalidGitHubResponseError", {
+    readonly operation: Schema.Literals<readonly ["create-repository-label", "discover-installation", "fetch-item-labels", "fetch-issue-snapshot", "fetch-pull-request-snapshot", "list-installation-repositories", "list-repository-labels", "mint-installation-token", "mint-worker-token", "poll-repository-changes", "update-item-labels"]>;
+    readonly message: Schema.NonEmptyString;
+    /** What made the response invalid: the decode path, the missing field, or the GraphQL errors. */
+    readonly detail: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** GitHub returned a response that cannot be decoded or is missing required content. */
+export declare class InvalidGitHubResponseError extends InvalidGitHubResponseError_base {
+}
+/** Failures from discovering installation access or making an authenticated GitHub request. */
+export declare const GitHubAppError: Schema.Union<readonly [typeof InstallationDiscoveryError, typeof AppPermissionError, typeof GitHubApiError, typeof GitHubRateLimitError, typeof InvalidGitHubResponseError]>;
+export type GitHubAppError = typeof GitHubAppError.Type;
+export {};
+//# sourceMappingURL=error.d.ts.map

package/dist/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sFAAsF;AACtF,eAAO,MAAM,eAAe,yTAY1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;;;;;;AAE1D,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,mBAMlC;CAAG;;;;;;AAEL,uFAAuF;AACvF,qBAAa,oBAAqB,SAAQ,yBAMxC;CAAG;;;;IAQH,iGAAiG;;;AANnG,wFAAwF;AACxF,qBAAa,0BAA2B,SAAQ,+BAO9C;CAAG;AAEL,+FAA+F;AAC/F,eAAO,MAAM,cAAc,8KAMzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC"}

package/dist/error.js

@@ -0,0 +1,48 @@
+import { Schema } from "effect";
+import { InstallationDiscoveryError } from "./installation.js";
+import { AppPermissionError } from "./access.js";
+/** The GitHub request that failed, shared by API, rate-limit, and response errors. */
+export const GitHubOperation = Schema.Literals([
+    "create-repository-label",
+    "discover-installation",
+    "fetch-item-labels",
+    "fetch-issue-snapshot",
+    "fetch-pull-request-snapshot",
+    "list-installation-repositories",
+    "list-repository-labels",
+    "mint-installation-token",
+    "mint-worker-token",
+    "poll-repository-changes",
+    "update-item-labels",
+]);
+/** A failed GitHub request, with an HTTP status when a response was received. */
+export class GitHubApiError extends Schema.TaggedError("@usine/github/GitHubApiError")("GitHubApiError", {
+    operation: GitHubOperation,
+    status: Schema.Option(Schema.Int),
+    message: Schema.NonEmptyString,
+}) {
+}
+/** GitHub deferred the request until retryAt; callers can schedule a later attempt. */
+export class GitHubRateLimitError extends Schema.TaggedError("@usine/github/GitHubRateLimitError")("GitHubRateLimitError", {
+    operation: GitHubOperation,
+    retryAt: Schema.DateTimeUtc,
+    message: Schema.NonEmptyString,
+}) {
+}
+/** GitHub returned a response that cannot be decoded or is missing required content. */
+export class InvalidGitHubResponseError extends Schema.TaggedError("@usine/github/InvalidGitHubResponseError")("InvalidGitHubResponseError", {
+    operation: GitHubOperation,
+    message: Schema.NonEmptyString,
+    /** What made the response invalid: the decode path, the missing field, or the GraphQL errors. */
+    detail: Schema.NonEmptyString,
+}) {
+}
+/** Failures from discovering installation access or making an authenticated GitHub request. */
+export const GitHubAppError = Schema.Union([
+    InstallationDiscoveryError,
+    AppPermissionError,
+    GitHubApiError,
+    GitHubRateLimitError,
+    InvalidGitHubResponseError,
+]);
+//# sourceMappingURL=error.js.map

package/dist/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7C,yBAAyB;IACzB,uBAAuB;IACvB,mBAAmB;IACnB,sBAAsB;IACtB,6BAA6B;IAC7B,gCAAgC;IAChC,wBAAwB;IACxB,yBAAyB;IACzB,mBAAmB;IACnB,yBAAyB;IACzB,oBAAoB;CACrB,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,CACpD,8BAA8B,CAC/B,CAAC,gBAAgB,EAAE;IAClB,SAAS,EAAE,eAAe;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,uFAAuF;AACvF,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,CAC1D,oCAAoC,CACrC,CAAC,sBAAsB,EAAE;IACxB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,MAAM,CAAC,WAAW;IAC3B,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAEL,wFAAwF;AACxF,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,CAChE,0CAA0C,CAC3C,CAAC,4BAA4B,EAAE;IAC9B,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,MAAM,CAAC,cAAc;IAC9B,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC,cAAc;CAC9B,CAAC;CAAG;AAEL,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC;IACzC,0BAA0B;IAC1B,kBAAkB;IAClB,cAAc;IACd,oBAAoB;IACpB,0BAA0B;CAC3B,CAAC,CAAC"}

package/dist/github-app.d.ts

@@ -0,0 +1,30 @@
+import { RepositoryName } from "@usine/core/repository";
+import { Context, Effect, Layer } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import { type AppAuthenticationError, GitHubCredentials } from "./credentials.ts";
+import { type CoveredProject, type ProjectAccess } from "./access.ts";
+import { type GitHubAppError } from "./error.ts";
+import { Installation, InstallationToken } from "./installation.ts";
+declare const GitHubApp_base: Context.ServiceClass<GitHubApp, "@usine/github/GitHubApp", {
+    /** Returns the App installation after checking its required permissions. */
+    readonly installation: () => Effect.Effect<Installation, GitHubAppError>;
+    /** Returns the shared installation-wide token for orchestrator operations, renewing it near expiry. */
+    readonly installationToken: () => Effect.Effect<InstallationToken, GitHubAppError>;
+    /** Reports access for every registry repository, retaining uncovered Projects as individual errors. */
+    readonly projectAccess: (registry: ReadonlyArray<RepositoryName>) => Effect.Effect<ReadonlyArray<ProjectAccess>, GitHubAppError>;
+    /** Mints a fresh token restricted to the covered Project's repository for a Worker. */
+    readonly workerToken: (project: CoveredProject) => Effect.Effect<InstallationToken, GitHubAppError>;
+}>;
+/**
+ * The factory's GitHub identity and repository access.
+ * Orchestrator operations share installation-wide access; each Worker token is
+ * newly minted for the repository assigned to its Attempt.
+ */
+export declare class GitHubApp extends GitHubApp_base {
+    static readonly layer: Layer.Layer<GitHubApp, AppAuthenticationError, GitHubCredentials | HttpClient.HttpClient>;
+}
+export { REQUIRED_REPOSITORY_PERMISSIONS, deriveProjectAccess, missingPermissions, type InstalledRepository, type RequiredRepositoryPermission, CoveredProject, ProjectNotInstalledError, ProjectAccess, AppPermissionError, } from "./access.ts";
+export { AppId, PrivateKey, RedactedPrivateKey, AppCredentials, GitHubCredentials, AppAuthenticationError, } from "./credentials.ts";
+export { InstallationId, RepositoryId, Installation, InstallationWide, SingleRepository, TokenScope, InstallationToken, InstallationDiscoveryReason, InstallationDiscoveryError, } from "./installation.ts";
+export { GitHubOperation, GitHubApiError, GitHubRateLimitError, InvalidGitHubResponseError, GitHubAppError, } from "./error.ts";
+//# sourceMappingURL=github-app.d.ts.map

package/dist/github-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../src/github-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAEL,OAAO,EAEP,MAAM,EACN,KAAK,EAKN,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,UAAU,EAAyC,MAAM,sBAAsB,CAAC;AAGzF,OAAO,EAAE,KAAK,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAEL,KAAK,cAAc,EAEnB,KAAK,aAAa,EAInB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,cAAc,EAIpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAGZ,iBAAiB,EAKlB,MAAM,mBAAmB,CAAC;;IA8DvB,4EAA4E;2BACrD,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC;IACxE,uGAAuG;gCAC3E,MAAM,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAClF,uGAAuG;4BAC/E,CACtB,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC;IAChE,uFAAuF;0BACjE,CACpB,OAAO,EAAE,cAAc,KACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;;AAnBzD;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,cAgBD;IAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAChC,SAAS,EACT,sBAAsB,EACtB,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAC1C,CAuLC;CACH;AAED,OAAO,EACL,+BAA+B,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,cAAc,EACd,wBAAwB,EACxB,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/github-app.js

@@ -0,0 +1,184 @@
+import { RepositoryName } from "@usine/core/repository";
+import { Clock, Context, DateTime, Effect, Layer, Option, Redacted, Schema, SynchronizedRef, } from "effect";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+import { appJwtSigner } from "./jwt.js";
+import { API_ROOT, authorized, invalidResponse, statusError, transportError } from "./http.js";
+import { GitHubCredentials } from "./credentials.js";
+import { AppPermissionError, REQUIRED_REPOSITORY_PERMISSIONS, deriveProjectAccess, missingPermissions, } from "./access.js";
+import { InvalidGitHubResponseError, } from "./error.js";
+import { Installation, InstallationDiscoveryError, InstallationId, InstallationToken, InstallationWide, RepositoryId, SingleRepository, } from "./installation.js";
+const TOKEN_MAX_LIFETIME_MS = 60 * 60 * 1_000;
+/** GitHub's expiry uses its own clock; ordinary worker/orchestrator skew is not a bad token. */
+const TOKEN_CLOCK_SKEW_MARGIN_MS = 3 * 60 * 1_000;
+/** Renew the shared lease when its token has less than this long left. */
+const LEASE_RENEWAL_MARGIN_MS = 5 * 60 * 1_000;
+const InstallationResponse = Schema.Struct({
+    id: InstallationId,
+    account: Schema.Struct({ login: Schema.NonEmptyString }),
+    permissions: Schema.Record(Schema.String, Schema.String),
+    suspendedAt: Schema.NullOr(Schema.String),
+}).pipe(Schema.encodeKeys({ suspendedAt: "suspended_at" }));
+const InstallationsResponse = Schema.Array(InstallationResponse);
+const RepositoryResponse = Schema.Struct({
+    id: RepositoryId,
+    name: RepositoryName,
+}).pipe(Schema.encodeKeys({ name: "full_name" }));
+const RepositoriesResponse = Schema.Struct({
+    totalCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+    repositories: Schema.Array(RepositoryResponse),
+}).pipe(Schema.encodeKeys({ totalCount: "total_count" }));
+const TokenResponse = Schema.Struct({
+    token: Schema.NonEmptyString,
+    expiresAt: Schema.DateTimeUtcFromString,
+    repositories: Schema.OptionFromOptionalKey(Schema.Array(RepositoryResponse)),
+}).pipe(Schema.encodeKeys({ expiresAt: "expires_at" }));
+/** The operation name and request body for minting a token of this scope. */
+const mintPlan = (scope) => scope._tag === "InstallationWide"
+    ? {
+        operation: "mint-installation-token",
+        body: { permissions: REQUIRED_REPOSITORY_PERMISSIONS },
+    }
+    : {
+        operation: "mint-worker-token",
+        body: {
+            permissions: REQUIRED_REPOSITORY_PERMISSIONS,
+            repository_ids: [scope.repositoryId],
+        },
+    };
+/**
+ * The factory's GitHub identity and repository access.
+ * Orchestrator operations share installation-wide access; each Worker token is
+ * newly minted for the repository assigned to its Attempt.
+ */
+export class GitHubApp extends Context.Service()("@usine/github/GitHubApp") {
+    static layer = Layer.effect(GitHubApp, Effect.gen(function* () {
+        const credentials = yield* GitHubCredentials;
+        const sign = yield* appJwtSigner(credentials);
+        const http = yield* HttpClient.HttpClient;
+        /** Sends one request and decodes its JSON body. Any other outcome is a typed GitHub error. */
+        const fetchJson = (operation, request, schema) => Effect.gen(function* () {
+            const response = yield* http
+                .execute(request)
+                .pipe(Effect.mapError((error) => transportError(operation, error)));
+            if (response.status < 200 || response.status >= 300) {
+                return yield* statusError(operation, response, yield* Clock.currentTimeMillis);
+            }
+            return yield* HttpClientResponse.schemaBodyJson(schema)(response).pipe(Effect.mapError((error) => invalidResponse(operation, error.message)));
+        });
+        const discoverInstallation = Effect.fn("GitHubApp.discoverInstallation")(function* () {
+            const jwt = yield* sign();
+            const [found, ...others] = yield* fetchJson("discover-installation", HttpClientRequest.get(`${API_ROOT}/app/installations?per_page=2`).pipe(authorized(jwt)), InstallationsResponse);
+            if (found === undefined) {
+                return yield* new InstallationDiscoveryError({
+                    reason: "missing",
+                    message: "The GitHub App is not installed on an account",
+                });
+            }
+            if (others.length > 0) {
+                return yield* new InstallationDiscoveryError({
+                    reason: "multiple",
+                    message: "The GitHub App must have exactly one installation for this factory",
+                });
+            }
+            if (found.suspendedAt !== null) {
+                return yield* new InstallationDiscoveryError({
+                    reason: "suspended",
+                    message: "The GitHub App installation is suspended",
+                });
+            }
+            const missing = missingPermissions(found.permissions);
+            if (missing.length > 0) {
+                return yield* new AppPermissionError({
+                    missing,
+                    message: `The GitHub App installation is missing permissions: ${missing.join(", ")}`,
+                });
+            }
+            return new Installation({ id: found.id, accountLogin: found.account.login });
+        });
+        const mintToken = Effect.fn("GitHubApp.mintToken")(function* (installationId, scope) {
+            const { operation, body } = mintPlan(scope);
+            yield* Effect.annotateCurrentSpan({ installationId, operation, scope: scope._tag });
+            const jwt = yield* sign();
+            const response = yield* fetchJson(operation, HttpClientRequest.post(`${API_ROOT}/app/installations/${installationId}/access_tokens`).pipe(HttpClientRequest.bodyJsonUnsafe(body), authorized(jwt)), TokenResponse);
+            const now = yield* Clock.currentTimeMillis;
+            const lifetime = DateTime.toEpochMillis(response.expiresAt) - now;
+            if (lifetime <= 0 || lifetime > TOKEN_MAX_LIFETIME_MS + TOKEN_CLOCK_SKEW_MARGIN_MS) {
+                return yield* new InvalidGitHubResponseError({
+                    operation,
+                    message: "GitHub returned an installation token outside the one-hour lifetime bound",
+                    detail: `expires_at ${DateTime.formatIso(response.expiresAt)} leaves ${lifetime}ms to live`,
+                });
+            }
+            if (lifetime > TOKEN_MAX_LIFETIME_MS) {
+                yield* Effect.logInfo("Accepted GitHub token clock skew; capped the local lease", {
+                    installationId,
+                    operation,
+                    skewMillis: lifetime - TOKEN_MAX_LIFETIME_MS,
+                });
+            }
+            const confirmed = Option.getOrElse(response.repositories, () => []);
+            if (scope._tag === "SingleRepository" &&
+                !(confirmed.length === 1 && confirmed.every((repo) => repo.id === scope.repositoryId))) {
+                return yield* new InvalidGitHubResponseError({
+                    operation,
+                    message: "GitHub did not confirm that the worker token is scoped to exactly one repo",
+                    detail: `expected repository id ${scope.repositoryId}, confirmed [${confirmed.map((repo) => repo.id).join(", ")}]`,
+                });
+            }
+            return new InstallationToken({
+                value: Redacted.make(response.token),
+                expiresAt: DateTime.makeUnsafe(now + Math.min(lifetime, TOKEN_MAX_LIFETIME_MS)),
+                scope,
+            });
+        });
+        const installedRepositories = Effect.fn("GitHubApp.installedRepositories")(function* (token) {
+            const installed = [];
+            for (let page = 1;; page += 1) {
+                const response = yield* fetchJson("list-installation-repositories", HttpClientRequest.get(`${API_ROOT}/installation/repositories?per_page=100&page=${page}`).pipe(authorized(token.value)), RepositoriesResponse);
+                installed.push(...response.repositories);
+                if (installed.length >= response.totalCount)
+                    return installed;
+                if (response.repositories.length === 0) {
+                    return yield* new InvalidGitHubResponseError({
+                        operation: "list-installation-repositories",
+                        message: "GitHub pagination ended before total_count repositories were returned",
+                        detail: `page ${page} was empty after ${installed.length} of ${response.totalCount} repositories`,
+                    });
+                }
+            }
+        });
+        const leaseRef = yield* SynchronizedRef.make(Option.none());
+        /** Returns the current lease, renewing it inside the ref when its token is under the margin. */
+        const lease = Effect.fn("GitHubApp.lease")(() => SynchronizedRef.modifyEffect(leaseRef, (current) => Effect.gen(function* () {
+            const now = yield* Clock.currentTimeMillis;
+            if (Option.isSome(current) &&
+                DateTime.toEpochMillis(current.value.token.expiresAt) - now > LEASE_RENEWAL_MARGIN_MS) {
+                const kept = [current.value, current];
+                return kept;
+            }
+            const installation = yield* discoverInstallation();
+            const token = yield* mintToken(installation.id, new InstallationWide());
+            const renewed = { installation, token };
+            const stored = [renewed, Option.some(renewed)];
+            return stored;
+        })));
+        return {
+            installation: Effect.fn("GitHubApp.installation")(() => Effect.map(lease(), (current) => current.installation)),
+            installationToken: Effect.fn("GitHubApp.installationToken")(() => Effect.map(lease(), (current) => current.token)),
+            projectAccess: Effect.fn("GitHubApp.projectAccess")(function* (registry) {
+                const { installation, token } = yield* lease();
+                const installed = yield* installedRepositories(token);
+                return deriveProjectAccess(installation, registry, installed);
+            }),
+            workerToken: Effect.fn("GitHubApp.workerToken")((project) => mintToken(project.installationId, new SingleRepository({
+                repository: project.repository,
+                repositoryId: project.repositoryId,
+            }))),
+        };
+    }));
+}
+export { REQUIRED_REPOSITORY_PERMISSIONS, deriveProjectAccess, missingPermissions, CoveredProject, ProjectNotInstalledError, ProjectAccess, AppPermissionError, } from "./access.js";
+export { AppId, PrivateKey, RedactedPrivateKey, AppCredentials, GitHubCredentials, AppAuthenticationError, } from "./credentials.js";
+export { InstallationId, RepositoryId, Installation, InstallationWide, SingleRepository, TokenScope, InstallationToken, InstallationDiscoveryReason, InstallationDiscoveryError, } from "./installation.js";
+export { GitHubOperation, GitHubApiError, GitHubRateLimitError, InvalidGitHubResponseError, GitHubAppError, } from "./error.js";
+//# sourceMappingURL=github-app.js.map