@coderook/cli 0.12.0 → 0.14.0

package/dist/desktop-app/src/main/detect.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.suggestExclusions = suggestExclusions;
+exports.rulesFromSuggestions = rulesFromSuggestions;
+/**
+ * Looking at a folder and saying what probably should not be uploaded.
+ *
+ * Choosing what goes up is the part of adding a project that people get wrong,
+ * and they get it wrong in one direction: a folder that has been worked in for
+ * a year holds a virtual environment, a build directory, somebody's browser
+ * profile and three copies of a release zip, and none of it is the work. The
+ * cost is not only storage — it is a save that takes twenty minutes and can be
+ * stopped outright by one file another program holds open.
+ *
+ * So this proposes. It never decides: everything it finds comes back as a
+ * suggestion with a reason and a size, the person ticks what they agree with,
+ * and a folder it recognises nothing in produces no suggestions rather than a
+ * default nobody asked for. Being wrong here has to be cheap, which it is
+ * exactly as long as nothing is applied without somebody saying so.
+ */
+const node_path_1 = __importDefault(require("node:path"));
+/*
+  Everything here is recoverable from something else in the project, or is
+  another program's working state. Nothing that could be somebody's only copy
+  of anything is marked recommended.
+*/
+const RULES = [
+    { directory: "node_modules", reason: "Installed packages — restored by installing again", recommended: true },
+    { directory: ".venv", reason: "Python virtual environment — rebuilt from requirements", recommended: true },
+    { directory: "venv", reason: "Python virtual environment — rebuilt from requirements", recommended: true },
+    { directory: "__pycache__", reason: "Python bytecode cache", recommended: true },
+    { directory: ".pytest_cache", reason: "Test runner cache", recommended: true },
+    { directory: ".mypy_cache", reason: "Type checker cache", recommended: true },
+    { directory: ".ruff_cache", reason: "Linter cache", recommended: true },
+    { directory: "target", reason: "Rust build output", recommended: true },
+    { directory: ".next", reason: "Next.js build output", recommended: true },
+    { directory: ".gradle", reason: "Gradle build state", recommended: true },
+    { directory: ".terraform", reason: "Downloaded Terraform providers", recommended: true },
+    /*
+      A Chromium or Electron profile left in the project folder. Worth its own
+      reason because the consequence is not only size: these hold lock files
+      another program keeps open, and one unreadable file stops the whole save.
+    */
+    { directory: "IndexedDB", reason: "Browser profile data — holds files another program keeps open", recommended: true },
+    { directory: "Local Storage", reason: "Browser profile data — holds files another program keeps open", recommended: true },
+    { directory: "Session Storage", reason: "Browser profile data — holds files another program keeps open", recommended: true },
+    { directory: "Service Worker", reason: "Browser profile data", recommended: true },
+    { directory: "GPUCache", reason: "Browser cache", recommended: true },
+    { directory: "Code Cache", reason: "Browser cache", recommended: true },
+    { directory: "blob_storage", reason: "Browser profile data", recommended: true },
+    /*
+      Build output and archives are usually regenerable, but "dist" is also a
+      perfectly ordinary folder name for hand-written files, so these are
+      offered rather than recommended.
+    */
+    { directory: "dist", reason: "Usually build output — check before excluding", recommended: false },
+    { directory: "build", reason: "Usually build output — check before excluding", recommended: false },
+    { directory: "out", reason: "Usually build output — check before excluding", recommended: false },
+    { extension: ".safetensors", reason: "Model weights — large, and usually downloadable", recommended: false },
+    { extension: ".ckpt", reason: "Model weights — large, and usually downloadable", recommended: false },
+    { extension: ".pt", reason: "Model weights — large, and usually downloadable", recommended: false },
+    { extension: ".pth", reason: "Model weights — large, and usually downloadable", recommended: false },
+    { extension: ".cbx", reason: "A CodeBox bundle of this project, inside the project", recommended: true },
+    { extension: ".pyc", reason: "Python bytecode", recommended: true },
+    { extension: ".log", reason: "Log files", recommended: false },
+    { file: "Local State", reason: "Browser profile data", recommended: true },
+    { file: "Preferences", reason: "Browser profile data", recommended: true },
+];
+const norm = (value) => value.split("\\").join("/");
+/**
+ * What this folder appears to contain that is not the work.
+ *
+ * Ordered by size, because the decision somebody is making is about how long
+ * their upload will take and the biggest item answers it. Anything matching
+ * nothing is simply absent — silence is the right output for a tidy folder.
+ */
+function suggestExclusions(files) {
+    const totals = new Map();
+    for (const entry of files) {
+        const relative = norm(entry.path);
+        const segments = relative.split("/");
+        const name = segments[segments.length - 1] ?? "";
+        const extension = node_path_1.default.extname(name).toLowerCase();
+        for (const rule of RULES) {
+            let pattern = null;
+            if (rule.directory && segments.slice(0, -1).includes(rule.directory)) {
+                pattern = `${rule.directory}/`;
+            }
+            else if (rule.file && name === rule.file) {
+                pattern = rule.file;
+            }
+            else if (rule.extension && extension === rule.extension) {
+                pattern = `*${rule.extension}`;
+            }
+            if (!pattern)
+                continue;
+            const held = totals.get(pattern) ?? { bytes: 0, files: 0, rule };
+            held.bytes += entry.size;
+            held.files += 1;
+            totals.set(pattern, held);
+            /*
+              One rule per file. The list is ordered from most specific to least, so
+              a .pyc inside __pycache__ is counted once, under the directory that
+              explains it, rather than inflating two separate suggestions.
+            */
+            break;
+        }
+    }
+    return [...totals.entries()]
+        .map(([pattern, held]) => ({
+        pattern,
+        reason: held.rule.reason,
+        bytes: held.bytes,
+        files: held.files,
+        recommended: held.rule.recommended,
+    }))
+        .sort((left, right) => right.bytes - left.bytes);
+}
+/**
+ * The suggestions a person accepted, as lines for the rules file.
+ *
+ * Written as its own step so that nothing is ever applied as a side effect of
+ * looking: the detector proposes, this records a decision, and the two are
+ * only connected by somebody choosing.
+ */
+function rulesFromSuggestions(accepted) {
+    if (!accepted.length)
+        return "";
+    return [
+        "# Suggested when this folder was added, and accepted.",
+        ...accepted.map((one) => one.pattern),
+        "",
+    ].join("\n");
+}

package/dist/desktop-app/src/main/download.js

@@ -14,10 +14,14 @@ exports.underway = underway;
  * not a file quietly written wrong.
  */
 const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
+const promises_2 = require("node:stream/promises");
+const node_stream_1 = require("node:stream");
 const node_path_1 = __importDefault(require("node:path"));
 const identify_js_1 = require("./identify.js");
 const faults_js_1 = require("./faults.js");
+const retry_js_1 = require("./retry.js");
 async function exists(target) {
     try {
         await (0, promises_1.stat)(target);
@@ -92,7 +96,38 @@ class Downloader {
         if (this.aborted)
             throw new DownloadCancelled();
     }
+    /**
+     * One request, repeated while repeating it might help.
+     *
+     * A restore makes at least one request per file and, for a file kept in
+     * pieces, one per piece — three thousand seven hundred and fifty-six for a
+     * single file here. At those numbers a dropped connection is not a risk but
+     * a certainty, and without this the whole restore ends on the first one.
+     */
     async request(route) {
+        let wait = retry_js_1.RETRY_FIRST_WAIT_MS;
+        for (let attempt = 1;; attempt += 1) {
+            this.check();
+            try {
+                return await this.attempt(route);
+            }
+            catch (error) {
+                // Its own cancellation first: `worthRetrying` knows nothing of it.
+                if (error instanceof DownloadCancelled)
+                    throw error;
+                if (attempt >= retry_js_1.RETRY_ATTEMPTS || !(0, retry_js_1.worthRetrying)(error))
+                    throw error;
+                try {
+                    await (0, retry_js_1.pauseFor)(this.controller.signal, wait);
+                }
+                catch {
+                    throw new DownloadCancelled();
+                }
+                wait *= 2;
+            }
+        }
+    }
+    async attempt(route) {
         const token = await this.credentials.token();
         if (!token)
             throw new Error("Sign in again before downloading");
@@ -116,13 +151,26 @@ class Downloader {
                     `update from ${tooOld.upgradeUrl}.`);
             }
             let message = `${route} failed (${response.status})`;
+            let code;
             try {
-                message = JSON.parse(text)?.error?.message ?? message;
+                const body = JSON.parse(text);
+                message = body?.error?.message ?? message;
+                code = body?.error?.code;
             }
             catch {
                 /* the body was not JSON; the status will have to do */
             }
-            throw new Error(message);
+            /*
+              The status travels with the error.
+      
+              Callers already reason about it — the retry rule asks whether a
+              failure is worth trying again, and the sync asks whether a project is
+              gone or merely unreachable — and both were reading a property that
+              was never set. A plain Error made every failure look identical, so a
+              404 for a deleted project was retried five times and then reported as
+              though the network were down.
+            */
+            throw Object.assign(new Error(message), { status: response.status, code });
         }
         return response;
     }
@@ -140,11 +188,106 @@ class Downloader {
     }
     async files(repositoryId, versionId) {
         const body = (await (await this.request(`/v1/repositories/${repositoryId}/versions/${versionId}/files`)).json());
-        return (body.files ?? []).map((row) => ({
-            path: String(row.path ?? ""),
-            sha256: String(row.sha256 ?? ""),
-            sourceSize: Number(row.sourceSize ?? 0),
-        }));
+        return (body.files ?? []).map((row) => {
+            const pieces = Array.isArray(row.chunks) ? row.chunks : null;
+            return {
+                path: String(row.path ?? ""),
+                sha256: String(row.sha256 ?? ""),
+                sourceSize: Number(row.sourceSize ?? 0),
+                ...(pieces && pieces.length
+                    ? {
+                        chunks: pieces.map((piece) => {
+                            const one = piece;
+                            return {
+                                objectId: String(one.objectId ?? ""),
+                                sha256: String(one.sha256 ?? ""),
+                                sourceSize: Number(one.sourceSize ?? 0),
+                            };
+                        }),
+                    }
+                    : {}),
+            };
+        });
+    }
+    /**
+     * Fetch one file to `target`, verifying it as it lands, and answer with the
+     * digest of what was actually written.
+     *
+     * A file kept in pieces is fetched piece by piece and assembled here rather
+     * than by the service. That is the whole point of this method. Asking the
+     * service to hand back one reassembled file made it loop over every piece
+     * inside a single edge invocation, and for a file of three thousand seven
+     * hundred and fifty-six pieces it ran out of whatever it runs out of and
+     * stopped — after the two hundred and its headers had already gone out. A
+     * 7.34 GB file came back as 5.09 GB under a clean `200`, with nothing in
+     * the response saying otherwise. Pulling the pieces from here bounds each
+     * request to one piece and puts the loop somewhere that can fail honestly.
+     *
+     * Nothing is held whole. The previous version read the entire file into one
+     * buffer to hash it, which for this file would have been 7.34 GB resident
+     * before the check it was there to perform could even run.
+     */
+    /**
+     * Fetch one file from a version to a chosen path, verified, and answer with
+     * the digest of what was written.
+     *
+     * Restoring a whole version is the usual case. This is the same machinery
+     * for somebody who wants one file out of one — and it is how a very large
+     * file can be checked on its own, without pulling down the project it
+     * belongs to in order to find out whether it survives the trip.
+     */
+    async fileTo(repositoryId, versionId, file, target) {
+        await (0, promises_1.mkdir)(node_path_1.default.dirname(target), { recursive: true });
+        return this.fetchInto(repositoryId, versionId, file, target);
+    }
+    async fetchInto(repositoryId, versionId, file, target) {
+        const whole = (0, node_crypto_1.createHash)("sha256");
+        const pieces = file.chunks ?? [];
+        // Captured so the generators below do not need `this` rebound.
+        const request = (route) => this.request(route);
+        const check = () => this.check();
+        const source = pieces.length
+            ? (async function* () {
+                for (let at = 0; at < pieces.length; at += 1) {
+                    check();
+                    const piece = pieces[at];
+                    const reply = await request(`/v1/repositories/${repositoryId}/objects/${piece.objectId}`);
+                    const body = Buffer.from(await reply.arrayBuffer());
+                    /*
+                      Checked against what the upload recorded for this piece, before
+                      a byte of it reaches the file. Without the digest the only
+                      available check was the whole file's, which says that something
+                      in seven gigabytes is wrong and nothing about what.
+                    */
+                    const digest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
+                    if (piece.sha256 && digest !== piece.sha256) {
+                        throw new Error(`${file.path}: piece ${at + 1} of ${pieces.length} ` +
+                            `did not arrive intact`);
+                    }
+                    whole.update(body);
+                    yield body;
+                }
+            })()
+            : (async function* () {
+                const reply = await request(`/v1/repositories/${repositoryId}/versions/${versionId}/file` +
+                    `?path=${encodeURIComponent(file.path)}`);
+                if (!reply.body)
+                    return;
+                for await (const block of node_stream_1.Readable.fromWeb(reply.body)) {
+                    check();
+                    const buffer = Buffer.from(block);
+                    whole.update(buffer);
+                    yield buffer;
+                }
+            })();
+        /*
+          `pipeline` rather than a write loop: it applies backpressure, and it
+          destroys the file handle when the source throws. A partially written
+          file left open on a failed verification is how a staging directory ends
+          up holding something that looks finished.
+        */
+        await (0, promises_2.pipeline)(source, (0, node_fs_1.createWriteStream)(target));
+        return whole.digest("hex");
     }
     /**
      * Write a version into `destination`.
@@ -194,19 +337,23 @@ class Downloader {
                 if (parts.some((part) => part === ".." || part.includes("\0"))) {
                     throw new Error(`That version contains an unsafe path: ${file.path}`);
                 }
-                const response = await this.request(`/v1/repositories/${repositoryId}/versions/${versionId}/file` +
-                    `?path=${encodeURIComponent(file.path)}`);
-                const body = Buffer.from(await response.arrayBuffer());
-                const digest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
+                const full = node_path_1.default.join(staging, ...parts);
+                await (0, promises_1.mkdir)(node_path_1.default.dirname(full), { recursive: true });
+                const digest = await this.fetchInto(repositoryId, versionId, file, full);
+                /*
+                  The whole file's digest, checked after every piece has already been
+                  checked individually. Both are needed: the pieces catch a corrupt or
+                  truncated piece and name it, and this catches a set of individually
+                  valid pieces assembled in the wrong order or with one missing —
+                  which is the failure that produces bytes that are all present, all
+                  verified, and wrong.
+                */
                 if (file.sha256 && digest !== file.sha256) {
                     throw new Error(`${file.path} did not arrive intact`);
                 }
-                const full = node_path_1.default.join(staging, ...parts);
-                await (0, promises_1.mkdir)(node_path_1.default.dirname(full), { recursive: true });
-                await (0, promises_1.writeFile)(full, body);
                 manifest[file.path] = digest;
                 written += 1;
-                bytes += body.length;
+                bytes += file.sourceSize;
             }
             /*
               Everything has arrived and verified, so it can go into place. Each

package/dist/desktop-app/src/main/profile.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.timed = timed;
+exports.counted = counted;
+exports.profileReport = profileReport;
+exports.resetProfile = resetProfile;
+/**
+ * Where an upload's time actually goes.
+ *
+ * Written because guessing was wrong twice. The first batching attempt was
+ * built on the assumption that HTTP round trips were the cost; they were about
+ * a tenth of it, and the real expense was ten database queries per object. The
+ * fix for that then revealed object storage as the next bottleneck. Neither
+ * would have been found by reading the code.
+ *
+ * Inert unless CODEROOK_PROFILE is set, so it costs a boolean check on a hot
+ * path and nothing else. It reports totals per named phase rather than a trace,
+ * because the question is always "which stage is the upload" and never "what
+ * happened at 14:32:07".
+ */
+const enabled = Boolean(process.env.CODEROOK_PROFILE);
+const phases = new Map();
+/** Time one awaited step and attribute it to a phase. */
+async function timed(phase, work) {
+    if (!enabled)
+        return work();
+    const started = performance.now();
+    try {
+        return await work();
+    }
+    finally {
+        const held = phases.get(phase) ?? { total: 0, count: 0 };
+        held.total += performance.now() - started;
+        held.count += 1;
+        phases.set(phase, held);
+    }
+}
+/** Count something that is not a duration — files batched, files sent alone. */
+function counted(phase, by = 1) {
+    if (!enabled)
+        return;
+    const held = phases.get(phase) ?? { total: 0, count: 0 };
+    held.count += by;
+    phases.set(phase, held);
+}
+/**
+ * What was measured, slowest first.
+ *
+ * Returns an empty string when profiling is off, so a caller can print it
+ * unconditionally without deciding whether there is anything to print.
+ */
+function profileReport() {
+    if (!enabled || !phases.size)
+        return "";
+    const rows = [...phases.entries()].sort((left, right) => right[1].total - left[1].total);
+    const width = Math.max(...rows.map(([name]) => name.length));
+    return [
+        "",
+        "where the time went:",
+        ...rows.map(([name, phase]) => {
+            const seconds = (phase.total / 1000).toFixed(1);
+            const each = phase.count && phase.total
+                ? ` (${(phase.total / phase.count).toFixed(1)}ms each)`
+                : "";
+            return phase.total
+                ? `  ${name.padEnd(width)}  ${seconds.padStart(7)}s  ×${phase.count}${each}`
+                : `  ${name.padEnd(width)}  ${String(phase.count).padStart(8)}`;
+        }),
+    ].join("\n");
+}
+function resetProfile() {
+    phases.clear();
+}

package/dist/desktop-app/src/main/retry.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Trying again, and knowing when not to.
+ *
+ * Both directions need this and neither had it. The uploader's absence of
+ * retries ended a twenty-eight gigabyte run at section fifty-one of
+ * eighty-seven, twenty-four minutes in, because one request came back `fetch
+ * failed`. The downloader has the same shape of problem and a worse
+ * consequence: a restore that gives up part way through has already written
+ * nothing usable, and the person is left without the thing they were
+ * restoring.
+ *
+ * It lives apart from both because the rule is the same for both and the
+ * cancellation is not. Each side has its own cancelled-error type, so each
+ * side checks for its own before asking this whether the failure was worth
+ * repeating. That keeps this module ignorant of either, rather than importing
+ * one into the other and coupling upload to download for a single `instanceof`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RETRY_FIRST_WAIT_MS = exports.RETRY_ATTEMPTS = void 0;
+exports.worthRetrying = worthRetrying;
+exports.pauseFor = pauseFor;
+/**
+ * How many times one request is attempted before giving up.
+ *
+ * Five attempts with doubling backoff covers an outage of roughly fifteen
+ * seconds, which is far longer than the reconnects that actually end long
+ * transfers. Longer than that and a genuine outage is being waited on rather
+ * than reported, which helps nobody.
+ */
+exports.RETRY_ATTEMPTS = 5;
+/** The first backoff. Doubles each attempt, and is jittered when used. */
+exports.RETRY_FIRST_WAIT_MS = 500;
+/**
+ * Whether a failure is worth trying again.
+ *
+ * The service's refusals are deliberate and none of them change on a second
+ * attempt: every 4xx it returns names a settled condition — the version is
+ * gone, the body is malformed, the quota is full — that a retry would meet
+ * again identically. Repeating those turns a clear answer into a long pause
+ * followed by the same answer, with the message that explained it buried under
+ * four pointless attempts.
+ *
+ * What is worth repeating is everything that never reached a verdict: a
+ * dropped connection, a gateway mid-restart, a request that timed out. Those
+ * carry no decision at all, and they are the whole failure population that
+ * ends long transfers.
+ *
+ * Cancellation is not considered here. It is a decision too — the user's —
+ * and each caller recognises its own before asking.
+ */
+function worthRetrying(error) {
+    const status = error.status;
+    if (typeof status !== "number") {
+        /*
+          No status means the request never got an answer — `fetch failed`, a
+          reset socket, a name that did not resolve. This is the case that ended
+          the twenty-eight gigabyte upload.
+        */
+        return true;
+    }
+    if (status === 429) {
+        /*
+          The one 4xx worth repeating, and only sometimes. A 429 from the edge is
+          throttling and clears in seconds. A 429 from the upload window is a
+          refusal that stands for days, so retrying it would hang the transfer
+          instead of showing the person the message that explains it.
+        */
+        return error.code !== "upload_rate_exceeded";
+    }
+    if (status === 408)
+        return true;
+    return status >= 500;
+}
+/**
+ * Wait, unless the signal aborts while waiting.
+ *
+ * Jittered, because the lanes fail together. Six requests against a gateway
+ * that has just gone away all fail within milliseconds of each other, and six
+ * retries timed from those failures would arrive together too — which turns
+ * one outage into a second one at precisely the wrong moment.
+ */
+function pauseFor(signal, ms) {
+    const delay = ms * (0.5 + Math.random());
+    return new Promise((resolve, reject) => {
+        const stop = () => {
+            clearTimeout(timer);
+            reject(new Error("aborted"));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", stop);
+            resolve();
+        }, delay);
+        signal.addEventListener("abort", stop, { once: true });
+    });
+}

package/dist/desktop-app/src/main/solid.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSolidPack = buildSolidPack;
+/**
+ * Many files compressed as one stream, the way the .cbx format does it.
+ *
+ * The upload path used to gzip each file on its own. That is the wrong shape
+ * for what a project actually holds: measured on a real folder, fifteen
+ * hundred small source files came to 42.9% of their size compressed
+ * individually and 30.2% compressed together. A two-kilobyte file gives a
+ * compressor nothing to work with — it starts cold, builds a dictionary out of
+ * two kilobytes, and throws it away. A thousand files from the same project
+ * share an enormous vocabulary, and only a shared stream can spend it.
+ *
+ * Notably the codec is not where the win is. Per-file zstd measured *worse*
+ * than per-file gzip on the same files (44.4% against 42.9%); it is the
+ * sharing that pays, not the algorithm.
+ *
+ * Gzip is used here rather than the format's Zstandard because the service has
+ * to be able to open a pack to serve one file out of it, and the Worker
+ * runtime can decompress gzip and cannot decompress zstd. That costs some
+ * ratio — zstd reached 30.2% where gzip reaches 36.2% — and it is the whole
+ * of the difference between this and what `packBundle` writes to disk.
+ */
+const node_crypto_1 = require("node:crypto");
+const node_zlib_1 = require("node:zlib");
+const node_util_1 = require("node:util");
+const deflate = (0, node_util_1.promisify)(node_zlib_1.gzip);
+/**
+ * Build one pack from a set of files.
+ *
+ * Members are laid end to end in the order given and each one's position is
+ * recorded, so the service can hand back any single file by decompressing up
+ * to its offset. Order is therefore not arbitrary: it is the index.
+ *
+ * Returns null when packing is not worth it — a pack of one file is just a
+ * compressed file with extra bookkeeping, and a pack that did not compress is
+ * a decompression step the service would pay for on every read forever.
+ */
+async function buildSolidPack(files) {
+    if (files.length < 2)
+        return null;
+    const members = [];
+    let offset = 0;
+    for (const file of files) {
+        members.push({
+            sha256: file.sha256,
+            offset,
+            length: file.body.byteLength,
+        });
+        offset += file.body.byteLength;
+    }
+    const stream = new Uint8Array(offset);
+    let at = 0;
+    for (const file of files) {
+        stream.set(file.body, at);
+        at += file.body.byteLength;
+    }
+    /*
+      Ask a sample before compressing the whole thing.
+  
+      Measured across a hundred and eighty real files, trial-compressing sixty
+      four kilobytes predicted the whole file's answer in all but one case — and
+      that one erred towards trying, which costs milliseconds, rather than
+      towards skipping, which would lose a real saving.
+  
+      It matters most exactly where packing is pointless: a pack of already
+      compressed images or video would otherwise be gzipped in full, at some
+      tens of megabytes per second, to discover what a sixty four kilobyte probe
+      says in under two milliseconds.
+    */
+    const probe = stream.subarray(0, Math.min(64 * 1024, stream.byteLength));
+    try {
+        const sampled = await deflate(probe, { level: 6 });
+        if (sampled.byteLength >= probe.byteLength * 0.95)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    let packed;
+    try {
+        packed = await deflate(stream, { level: 6 });
+    }
+    catch {
+        return null;
+    }
+    /*
+      Measured, not assumed. A pack of already-compressed files — a folder of
+      images, a directory of archives — comes out no smaller, and storing it as
+      a pack would buy nothing while making every later read of a single file
+      decompress the whole thing up to its offset.
+    */
+    if (packed.byteLength >= stream.byteLength * 0.95)
+        return null;
+    return {
+        body: new Uint8Array(packed),
+        storedSha256: (0, node_crypto_1.createHash)("sha256").update(packed).digest("hex"),
+        sha256: (0, node_crypto_1.createHash)("sha256").update(stream).digest("hex"),
+        size: stream.byteLength,
+        members,
+    };
+}