co-maintainer 0.4.0-beta.1

package/dist/src/github/app.js

@@ -0,0 +1,120 @@
+import { githubFetch, GitHubHttpError, paginate } from "./client.js";
+import { importAppPrivateKey, signAppJwt } from "./jwt.js";
+const API = "https://api.github.com";
+function headers(token) {
+    return {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+    };
+}
+async function call(endpoint, token, init = {}) {
+    const response = await githubFetch(`${API}/${endpoint}`, {
+        ...init,
+        headers: { ...headers(token), ...(init.headers ?? {}) },
+    });
+    if (!response.ok) {
+        throw new GitHubHttpError(response.status, await response.text());
+    }
+    if (response.status === 204)
+        return undefined;
+    return (await response.json());
+}
+async function get(endpoint, token) {
+    return await call(endpoint, token);
+}
+const installationTokens = new Map();
+/** App-level calls: list installations, mint an installation access token.
+ * Not scoped to one installation — `AppClient` below is. */
+export class AppJwtClient {
+    appId;
+    privateKeyPem;
+    constructor(appId, privateKeyPem) {
+        this.appId = appId;
+        this.privateKeyPem = privateKeyPem;
+    }
+    async jwt() {
+        const key = await importAppPrivateKey(this.privateKeyPem);
+        return await signAppJwt(this.appId, key);
+    }
+    async listInstallations() {
+        const jwt = await this.jwt();
+        return await paginate((endpoint) => get(endpoint, jwt), "app/installations");
+    }
+    /** Cached until 60s before the token's own `expires_at`. */
+    async installationToken(installationId) {
+        const cached = installationTokens.get(installationId);
+        if (cached && cached.expiresAt > Date.now() + 60_000)
+            return cached.token;
+        const jwt = await this.jwt();
+        const response = await githubFetch(`${API}/app/installations/${installationId}/access_tokens`, {
+            method: "POST",
+            headers: headers(jwt),
+        });
+        if (!response.ok) {
+            throw new Error(`GitHub API ${response.status}: ${await response.text()}`);
+        }
+        const body = (await response.json());
+        const expiresAt = new Date(body.expires_at).getTime();
+        installationTokens.set(installationId, { token: body.token, expiresAt });
+        return body.token;
+    }
+}
+/** A `GitHubClient` scoped to one installation. */
+export class AppClient {
+    app;
+    installationId;
+    constructor(appId, privateKeyPem, installationId) {
+        this.app = new AppJwtClient(appId, privateKeyPem);
+        this.installationId = installationId;
+    }
+    async request(endpoint) {
+        return await get(endpoint, await this.app.installationToken(this.installationId));
+    }
+    async pages(endpoint, limit, progress) {
+        const token = await this.app.installationToken(this.installationId);
+        return await paginate((e) => get(e, token), endpoint, limit, progress);
+    }
+    async write(endpoint, body) {
+        return await call(endpoint, await this.app.installationToken(this.installationId), {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    async createCheckRun(endpoint, body) {
+        return await this.write(endpoint, body);
+    }
+    async updateCheckRun(endpoint, body) {
+        return await call(endpoint, await this.app.installationToken(this.installationId), {
+            method: "PATCH",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+}
+/** For `GET /api/installations`: every installation the App has, each with
+ * the repos it can see. */
+export async function listInstallationsWithRepos(appId, privateKeyPem) {
+    const app = new AppJwtClient(appId, privateKeyPem);
+    const installations = await app.listInstallations();
+    const result = [];
+    for (const installation of installations) {
+        const token = await app.installationToken(installation.id);
+        const body = await get("installation/repositories", token);
+        const repos = Array.isArray(body.repositories)
+            ? body.repositories.map((repo) => ({
+                fullName: String(repo.full_name ?? ""),
+                private: Boolean(repo.private),
+            }))
+            : [];
+        result.push({ installation, repos });
+    }
+    return result;
+}
+export async function findInstallationForRepo(appId, privateKeyPem, fullName) {
+    const normalized = fullName.toLowerCase();
+    const installations = await listInstallationsWithRepos(appId, privateKeyPem);
+    const match = installations.find(({ repos }) => repos.some((repo) => repo.fullName.toLowerCase() === normalized));
+    return match?.installation.id;
+}

package/dist/src/github/client.d.ts

@@ -0,0 +1,17 @@
+/** Shared by every `GitHubClient` implementation that talks over `fetch`
+ * (pat.ts, and app.ts in P5). `GhClient` shells out to the `gh` binary,
+ * which already retries on its own, so it never calls `githubFetch` — it
+ * still shares `paginate`, the one 20-line loop every client used to carry
+ * its own copy of. */
+export declare class GitHubHttpError extends Error {
+    readonly status: number;
+    constructor(status: number, body: string);
+}
+export declare function isAccessDenied(error: unknown): boolean;
+/** A secondary (abuse-detection) rate limit carries a short `retry-after`
+ * and is retried in place, up to three attempts total. A primary limit at
+ * zero remaining fails the request right away, with the reset time in the
+ * message, rather than pausing the caller for however long that reset
+ * takes — the caller decides whether to wait, not this function. */
+export declare function githubFetch(url: string, init: RequestInit): Promise<Response>;
+export declare function paginate<T>(request: (endpoint: string) => Promise<T[]>, endpoint: string, limit?: number, progress?: (page: number, fetched: number) => void): Promise<T[]>;

package/dist/src/github/client.js

@@ -0,0 +1,66 @@
+/** Shared by every `GitHubClient` implementation that talks over `fetch`
+ * (pat.ts, and app.ts in P5). `GhClient` shells out to the `gh` binary,
+ * which already retries on its own, so it never calls `githubFetch` — it
+ * still shares `paginate`, the one 20-line loop every client used to carry
+ * its own copy of. */
+export class GitHubHttpError extends Error {
+    status;
+    constructor(status, body) {
+        super(`GitHub API ${status}: ${body}`);
+        this.status = status;
+        this.name = "GitHubHttpError";
+    }
+}
+export function isAccessDenied(error) {
+    return (error instanceof GitHubHttpError &&
+        (error.status === 403 || error.status === 404));
+}
+function rateLimit(headers) {
+    const remaining = headers.get("x-ratelimit-remaining");
+    const reset = headers.get("x-ratelimit-reset");
+    if (remaining === null || reset === null)
+        return undefined;
+    return {
+        remaining: Number(remaining),
+        resetAt: new Date(Number(reset) * 1000),
+    };
+}
+/** A secondary (abuse-detection) rate limit carries a short `retry-after`
+ * and is retried in place, up to three attempts total. A primary limit at
+ * zero remaining fails the request right away, with the reset time in the
+ * message, rather than pausing the caller for however long that reset
+ * takes — the caller decides whether to wait, not this function. */
+export async function githubFetch(url, init) {
+    let response;
+    for (let attempt = 1; attempt <= 3; attempt++) {
+        response = await fetch(url, init);
+        if (response.status !== 403 && response.status !== 429)
+            return response;
+        const retryAfterHeader = response.headers.get("retry-after");
+        const retryAfter = retryAfterHeader === null ? NaN : Number(retryAfterHeader);
+        if (Number.isFinite(retryAfter) && retryAfter >= 0 && attempt < 3) {
+            console.log(`[github] secondary rate limit, waiting ${retryAfter}s (attempt ${attempt} of 3)`);
+            await new Promise((resolve) => setTimeout(resolve, retryAfter * 1000));
+            continue;
+        }
+        const limit = rateLimit(response.headers);
+        if (limit && limit.remaining === 0) {
+            throw new Error(`GitHub rate limit exhausted, resets at ${limit.resetAt.toISOString()}`);
+        }
+        return response;
+    }
+    return response;
+}
+export async function paginate(request, endpoint, limit, progress) {
+    const items = [];
+    for (let page = 1;; page++) {
+        const separator = endpoint.includes("?") ? "&" : "?";
+        const pageItems = await request(`${endpoint}${separator}per_page=100&page=${page}`);
+        items.push(...pageItems);
+        progress?.(page, items.length);
+        if (pageItems.length < 100 ||
+            (limit !== undefined && items.length >= limit))
+            break;
+    }
+    return limit === undefined ? items : items.slice(0, limit);
+}

package/dist/src/github/collect.d.ts

@@ -0,0 +1,7 @@
+import type { GitHubClient, Options } from "../types.ts";
+import type { PullRequest, Source, State } from "../knowledge/types.ts";
+export declare function collectSource(client: GitHubClient, options: Options, previous?: State, progress?: (items: PullRequest[]) => Promise<void>, codebaseProgress?: (data: {
+    tree: string[];
+    treeSha: Record<string, string>;
+    files: Record<string, string>;
+}) => Promise<void>): Promise<Source>;

package/dist/src/github/collect.js

@@ -0,0 +1,368 @@
+import { log, startHeartbeat } from "../util/log.js";
+import { cacheGet, cacheSet } from "../store/cache_db.js";
+function decodeBase64(value) {
+    const binary = atob(value.replaceAll("\n", ""));
+    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+function percent(done, total) {
+    if (total <= 0)
+        return "0%";
+    return `${Math.round((done / total) * 100)}%`;
+}
+function withinPrWindow(updatedAt, months) {
+    if (months === undefined || months === 0)
+        return true;
+    const cutoff = new Date();
+    cutoff.setMonth(cutoff.getMonth() - months);
+    return new Date(updatedAt) >= cutoff;
+}
+function listingCovers(cachedMonths, current) {
+    if (cachedMonths === 0)
+        return true;
+    if (current === undefined || current === 0)
+        return false;
+    return cachedMonths >= current;
+}
+async function loadListing(repo) {
+    const raw = await cacheGet("pr-listing", repo);
+    if (!raw)
+        return undefined;
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed.items))
+        return undefined;
+    return parsed;
+}
+async function saveListing(repo, maxPrMonths, items) {
+    await cacheSet("pr-listing", repo, JSON.stringify({ maxPrMonths: maxPrMonths ?? 0, items }));
+}
+async function listPullRequestPages(client, options, phase) {
+    const cached = await loadListing(options.repo);
+    const canCatchUp = cached !== undefined &&
+        listingCovers(cached.maxPrMonths, options.maxPrMonths);
+    const cachedByNumber = new Map((cached?.items ?? []).map((pr) => [Number(pr.number), pr]));
+    const selected = [];
+    const seen = new Set();
+    const concurrency = Math.max(1, options.ghConcurrent);
+    log("fetch", `pull request listing · concurrency=${concurrency}`);
+    const fetchPage = async (page) => {
+        const pageItems = await client.request(`repos/${options.repo}/pulls?state=all&sort=updated&direction=desc&per_page=100&page=${page}`);
+        return Array.isArray(pageItems) ? pageItems : [];
+    };
+    const ingest = (page, pageItems) => {
+        if (pageItems.length === 0) {
+            const message = `pull request listing · page ${page} · fetched ${selected.length} · done`;
+            if (phase)
+                phase.text = message;
+            log("fetch", message);
+            return true;
+        }
+        let stop = false;
+        let reason = "total unknown";
+        for (const pr of pageItems) {
+            const updatedAt = String(pr.updated_at ?? "");
+            if (!withinPrWindow(updatedAt, options.maxPrMonths)) {
+                stop = true;
+                reason = "window reached";
+                break;
+            }
+            const number = Number(pr.number);
+            selected.push(pr);
+            seen.add(number);
+            const prior = cachedByNumber.get(number);
+            if (canCatchUp && String(prior?.updated_at ?? "") === updatedAt) {
+                stop = true;
+                reason = "cache catch-up";
+                break;
+            }
+        }
+        const message = `pull request listing · page ${page} · fetched ${selected.length} · ${reason}`;
+        if (phase)
+            phase.text = message;
+        log("fetch", message);
+        return stop || pageItems.length < 100;
+    };
+    const first = await fetchPage(1);
+    let done = ingest(1, first);
+    let page = 2;
+    while (!done) {
+        const batch = Array.from({ length: concurrency }, (_, index) => page + index);
+        const pages = await mapPool(batch, concurrency, (item) => fetchPage(item));
+        for (let index = 0; index < pages.length; index++) {
+            if (ingest(batch[index], pages[index])) {
+                done = true;
+                break;
+            }
+        }
+        page += concurrency;
+    }
+    if (canCatchUp) {
+        let reused = 0;
+        for (const pr of cached?.items ?? []) {
+            const number = Number(pr.number);
+            if (seen.has(number))
+                continue;
+            if (!withinPrWindow(String(pr.updated_at ?? ""), options.maxPrMonths)) {
+                continue;
+            }
+            selected.push(pr);
+            seen.add(number);
+            reused++;
+        }
+        if (reused > 0) {
+            log("fetch", `pull request listing · reused ${reused} cached PRs · ${selected.length} total`);
+        }
+    }
+    await saveListing(options.repo, options.maxPrMonths, selected);
+    return selected;
+}
+async function mapPool(items, concurrency, fn) {
+    const results = new Array(items.length);
+    if (items.length === 0)
+        return results;
+    let cursor = 0;
+    const worker = async () => {
+        while (cursor < items.length) {
+            const index = cursor++;
+            results[index] = await fn(items[index], index);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(Math.max(1, concurrency), items.length) }, worker));
+    return results;
+}
+async function file(client, repo, path, branch) {
+    try {
+        const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+        const result = await client.request(`repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`);
+        if (typeof result.content !== "string")
+            return undefined;
+        return decodeBase64(result.content);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function codebase(client, repo, meta, concurrency, previous, phase, progress) {
+    const branch = String(meta.default_branch ?? "main");
+    const response = await client.request(`repos/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`);
+    const blobs = Array.isArray(response.tree)
+        ? response.tree.filter((item) => item.type === "blob")
+        : [];
+    const tree = blobs.map((item) => String(item.path));
+    const treeSha = Object.fromEntries(blobs.map((item) => {
+        const value = item;
+        return [String(value.path), String(value.sha ?? "")];
+    }));
+    const canonical = tree.filter((path) => /(^|\/)(README|CONTRIBUTING|CODE_OF_CONDUCT|SECURITY|CHANGELOG)(\.[^/]*)?$|(^|\/)(package\.json|deno\.json|Cargo\.toml|Makefile|justfile|CODEOWNERS|build\.rs)$|^\.github\/(workflows\/.+\.(yml|yaml)|PULL_REQUEST_TEMPLATE.*)$/i.test(path));
+    const representative = tree
+        .filter((path) => /\.(rs|ts|tsx|js|jsx|py|go|java|cs|cpp|c|swift)$/i.test(path) &&
+        !/(^|\/)(test|tests|vendor|dist|target)\//i.test(path))
+        .slice(0, 20);
+    const important = [...new Set([...canonical, ...representative])].slice(0, 80);
+    const files = {};
+    let completed = 0;
+    let save = Promise.resolve();
+    if (phase) {
+        phase.text = `codebase files 0/${important.length} · 0% · concurrency=${concurrency}`;
+    }
+    log("fetch", `codebase · ${important.length} files · concurrency=${concurrency}`);
+    const checkpoint = () => {
+        if (!progress)
+            return Promise.resolve();
+        save = save.then(() => progress({ tree, treeSha, files: { ...files } }));
+        return save;
+    };
+    await mapPool(important, concurrency, async (path) => {
+        if (previous?.treeSha?.[path] &&
+            previous.treeSha[path] === treeSha[path] &&
+            previous.files[path] !== undefined) {
+            files[path] = previous.files[path];
+            completed++;
+            if (phase) {
+                phase.text = `codebase files ${completed}/${important.length} · ${percent(completed, important.length)}`;
+            }
+            log("fetch", `codebase cache ${completed}/${important.length} · ${percent(completed, important.length)}: ${path}`);
+            await checkpoint();
+            return;
+        }
+        const content = await file(client, repo, path, branch);
+        if (content !== undefined && content.length <= 200_000) {
+            files[path] = content;
+        }
+        completed++;
+        if (phase) {
+            phase.text = `codebase files ${completed}/${important.length} · ${percent(completed, important.length)}`;
+        }
+        log("fetch", `codebase file ${completed}/${important.length} · ${percent(completed, important.length)}: ${path}`);
+        await checkpoint();
+    });
+    return { tree, treeSha, files };
+}
+async function pullRequests(client, options, previous, phase, progress) {
+    if (phase)
+        phase.text = "listing pull requests · page 0 · fetched 0";
+    const selected = await listPullRequestPages(client, options, phase);
+    const previousByNumber = new Map((previous?.source.pullRequests ?? []).map((pr) => [pr.number, pr]));
+    const result = new Array(selected.length);
+    let completed = 0;
+    let save = Promise.resolve();
+    if (phase) {
+        phase.text = `pull requests 0/${selected.length} · 0% · concurrency=${options.ghConcurrent}`;
+    }
+    log("fetch", `${selected.length} pull requests · concurrency=${options.ghConcurrent}`);
+    await mapPool(selected, options.ghConcurrent, async (pr, index) => {
+        const number = Number(pr.number);
+        const cached = previousByNumber.get(number);
+        const listedAdditions = Number(pr.additions);
+        const listedDeletions = Number(pr.deletions);
+        const listedStatsAvailable = Number.isFinite(listedAdditions) &&
+            Number.isFinite(listedDeletions) &&
+            pr.additions !== undefined &&
+            pr.deletions !== undefined;
+        const cachedStatsAvailable = cached &&
+            cached.updatedAt === String(pr.updated_at ?? "") &&
+            cached.headSha === String(pr.head?.sha ?? "") &&
+            Number.isFinite(cached.additions) &&
+            Number.isFinite(cached.deletions);
+        let detail = listedStatsAvailable
+            ? pr
+            : cachedStatsAvailable
+                ? {
+                    additions: cached.additions,
+                    deletions: cached.deletions,
+                }
+                : undefined;
+        if (!detail) {
+            try {
+                detail = await client.request(`repos/${options.repo}/pulls/${number}`);
+            }
+            catch (error) {
+                log("fetch", `PR #${number} detail unavailable; diff skipped: ${String(error)}`);
+            }
+        }
+        const current = {
+            number,
+            title: String(pr.title ?? ""),
+            body: String(pr.body ?? ""),
+            state: String(pr.state ?? ""),
+            merged: Boolean(pr.merged_at),
+            updatedAt: String(pr.updated_at ?? ""),
+            headSha: String(pr.head?.sha ?? ""),
+            labels: Array.isArray(pr.labels)
+                ? pr.labels.map((label) => String(label.name))
+                : [],
+            additions: Number(detail?.additions ?? cached?.additions ?? 0),
+            deletions: Number(detail?.deletions ?? cached?.deletions ?? 0),
+            comments: cached?.comments ?? [],
+            reviews: cached?.reviews ?? [],
+            changedFiles: cached?.changedFiles ?? [],
+            diff: cached?.diff ?? "",
+        };
+        const discussionUnchanged = cached?.updatedAt === current.updatedAt;
+        const diffUnchanged = cached?.headSha === current.headSha && Boolean(cached?.diff);
+        const discussionStatus = discussionUnchanged
+            ? "comments/reviews cache"
+            : "download comments/reviews";
+        let diffStatus = "diff disabled";
+        if (options.includePullRequestChanges) {
+            const lines = current.additions + current.deletions;
+            diffStatus = diffUnchanged
+                ? "diff cache"
+                : !detail
+                    ? "diff unavailable"
+                    : options.maxPullRequestChangeLines !== undefined &&
+                        lines > options.maxPullRequestChangeLines
+                        ? `diff skipped (${lines} lines > limit)`
+                        : "download diff";
+        }
+        if (phase) {
+            phase.text = `PR #${number} · ${discussionStatus} · ${diffStatus} · ${completed}/${selected.length} · ${percent(completed, selected.length)}`;
+        }
+        if (!discussionUnchanged) {
+            const comments = await client.pages(`repos/${options.repo}/issues/${number}/comments`);
+            const reviews = await client.pages(`repos/${options.repo}/pulls/${number}/reviews`);
+            current.comments = comments
+                .map((comment) => String(comment.body ?? ""))
+                .filter(Boolean)
+                .slice(0, options.maxComments);
+            current.reviews = reviews
+                .map((review) => String(review.body ?? ""))
+                .filter(Boolean);
+        }
+        if (options.includePullRequestChanges && !diffUnchanged && detail) {
+            const lines = current.additions + current.deletions;
+            if (options.maxPullRequestChangeLines === undefined ||
+                lines <= options.maxPullRequestChangeLines) {
+                const files = await client.pages(`repos/${options.repo}/pulls/${number}/files`);
+                current.changedFiles = files
+                    .map((item) => String(item.filename))
+                    .filter(Boolean);
+                current.diff = files
+                    .map((item) => {
+                    const path = String(item.filename ?? "");
+                    const patch = String(item.patch ?? "");
+                    return patch ? `FILE: ${path}\n${patch}` : "";
+                })
+                    .filter(Boolean)
+                    .join("\n\n");
+            }
+            else {
+                current.changedFiles = [];
+                current.diff = "";
+            }
+        }
+        result[index] = current;
+        completed++;
+        if (phase) {
+            phase.text = `pull requests ${completed}/${selected.length} · ${percent(completed, selected.length)}`;
+        }
+        log("fetch", `PR ${completed}/${selected.length} · ${percent(completed, selected.length)} #${number} · ${discussionStatus} · ${diffStatus}`);
+        if (progress) {
+            save = save.then(() => progress(result.filter((item) => !!item)));
+            await save;
+        }
+    });
+    return result;
+}
+async function commits(client, options, meta, phase) {
+    const branch = String(meta.default_branch ?? "main");
+    const limit = options.maxCommits && options.maxCommits > 0
+        ? options.maxCommits
+        : undefined;
+    if (phase)
+        phase.text = "commit history · page 0 · fetched 0";
+    return client.pages(`repos/${options.repo}/commits?sha=${encodeURIComponent(branch)}`, limit, (page, fetched) => {
+        const message = `commit history · page ${page} · fetched ${fetched} · total unknown`;
+        if (phase)
+            phase.text = message;
+        log("fetch", message);
+    });
+}
+export async function collectSource(client, options, previous, progress, codebaseProgress) {
+    const phase = { text: "reading repository metadata" };
+    const stopHeartbeat = startHeartbeat(() => phase.text);
+    try {
+        const repo = await client.request(`repos/${options.repo}`);
+        const includeCodebase = options.includeCodebase || options.includeHowRepoWorks;
+        const files = includeCodebase
+            ? await codebase(client, options.repo, repo, options.ghConcurrent, previous?.source, phase, codebaseProgress)
+            : { tree: [], treeSha: {}, files: {} };
+        const pullRequestData = options.includePullRequests
+            ? await pullRequests(client, options, previous, phase, progress)
+            : [];
+        const commitData = options.includeCommitHistory
+            ? await commits(client, options, repo, phase)
+            : [];
+        return {
+            repo,
+            tree: files.tree,
+            treeSha: files.treeSha,
+            files: files.files,
+            pullRequests: pullRequestData,
+            commits: commitData,
+        };
+    }
+    finally {
+        stopHeartbeat();
+    }
+}

package/dist/src/github/gh.d.ts

@@ -0,0 +1,8 @@
+import type { GitHubClient } from "../types.ts";
+export declare class GhClient implements GitHubClient {
+    request<T>(endpoint: string): Promise<T>;
+    write<T>(endpoint: string, body: unknown): Promise<T>;
+    createCheckRun<T>(endpoint: string, body: unknown): Promise<T>;
+    updateCheckRun<T>(endpoint: string, body: unknown): Promise<T>;
+    pages<T>(endpoint: string, limit?: number, progress?: (page: number, fetched: number) => void): Promise<T[]>;
+}

package/dist/src/github/gh.js

@@ -0,0 +1,63 @@
+import { paginate } from "./client.js";
+import { commandOutput, commandWithInput } from "../util/runtime.js";
+export class GhClient {
+    async request(endpoint) {
+        const result = await commandOutput("gh", {
+            args: ["api", endpoint],
+            stdout: "piped",
+            stderr: "piped",
+        });
+        if (!result.success) {
+            const error = new TextDecoder().decode(result.stderr).trim();
+            throw new Error(`gh api failed: ${error || endpoint}`);
+        }
+        try {
+            return JSON.parse(new TextDecoder().decode(result.stdout));
+        }
+        catch {
+            throw new Error(`gh returned invalid JSON for ${endpoint}`);
+        }
+    }
+    async write(endpoint, body) {
+        const result = await commandWithInput("gh", {
+            args: ["api", "-X", "POST", endpoint, "--input", "-"],
+            stdin: "piped",
+            stdout: "piped",
+            stderr: "piped",
+        }, JSON.stringify(body));
+        if (!result.success) {
+            const error = new TextDecoder().decode(result.stderr).trim();
+            throw new Error(`gh api failed: ${error || endpoint}`);
+        }
+        try {
+            return JSON.parse(new TextDecoder().decode(result.stdout));
+        }
+        catch {
+            throw new Error(`gh returned invalid JSON for ${endpoint}`);
+        }
+    }
+    async createCheckRun(endpoint, body) {
+        return await this.write(endpoint, body);
+    }
+    async updateCheckRun(endpoint, body) {
+        const result = await commandWithInput("gh", {
+            args: ["api", "-X", "PATCH", endpoint, "--input", "-"],
+            stdin: "piped",
+            stdout: "piped",
+            stderr: "piped",
+        }, JSON.stringify(body));
+        if (!result.success) {
+            const error = new TextDecoder().decode(result.stderr).trim();
+            throw new Error(`gh api failed: ${error || endpoint}`);
+        }
+        try {
+            return JSON.parse(new TextDecoder().decode(result.stdout));
+        }
+        catch {
+            throw new Error(`gh returned invalid JSON for ${endpoint}`);
+        }
+    }
+    pages(endpoint, limit, progress) {
+        return paginate((e) => this.request(e), endpoint, limit, progress);
+    }
+}

package/dist/src/github/jwt.d.ts

@@ -0,0 +1,12 @@
+/** GitHub hands out App private keys as PKCS#1 PEM ("BEGIN RSA PRIVATE
+ * KEY"). Web Crypto's `importKey("pkcs8", ...)` only takes PKCS#8. The two
+ * differ by a fixed 26-byte wrapper around the same PKCS#1 bytes: a version
+ * INTEGER, the rsaEncryption AlgorithmIdentifier, and an OCTET STRING tag
+ * around the PKCS#1 payload — this file builds that wrapper by hand rather
+ * than pulling in an ASN.1 library for one fixed structure. */
+export declare function pkcs1ToPkcs8(pkcs1: Uint8Array): Uint8Array;
+export declare function importAppPrivateKey(pem: string): Promise<CryptoKey>;
+/** GitHub requires `exp` no more than 10 minutes out and tolerates `iat` a
+ * little in the past to absorb clock drift between this machine and
+ * GitHub's. */
+export declare function signAppJwt(appId: string, key: CryptoKey): Promise<string>;