@foldrun/core 1.4.1 → 2.0.0

package/dist/src/gitrepo.d.ts

@@ -1,113 +0,0 @@
-import type { DiffOp, Revision, RevisionFile, RevisionSummary } from "./history.ts";
-/** Where a workspace's bare repository lives. `@library` is the account shelf. */
-export declare function repoDir(tenant: string, scope: string): string;
-/** Is there a git binary? Checked once; an install without one keeps the journal. */
-export declare function gitAvailable(): boolean;
-export declare function repoExists(tenant: string, scope: string): boolean;
-/** Create the repository if it is not there. Idempotent. */
-export declare function ensureRepo(tenant: string, scope: string): string;
-export declare function headSha(tenant: string, scope: string, ref?: string): string | null;
-/**
- * Apply a change set as one commit on main, using plumbing against a scratch
- * index seeded from HEAD. No working copy, no checkout: each changed path is
- * hashed straight from its content into the object store.
- *
- * Returns the new commit, or null when the tree did not change.
- */
-export declare function commitChanges(tenant: string, scope: string, files: RevisionFile[], meta?: {
-    by?: string;
-    message?: string;
-    at?: string;
-}): string | null;
-/** Commits on main, newest first, as the same summary the journal gave. */
-export declare function listCommits(tenant: string, scope: string, opts?: {
-    forPath?: string;
-    limit?: number;
-    ref?: string;
-}): RevisionSummary[];
-/** One commit in full: every changed file with its before and after. */
-export declare function readCommit(tenant: string, scope: string, sha: string, forPath?: string): Revision | null;
-export interface RefInfo {
-    name: string;
-    sha: string;
-    /** Commit subject and time, for a branch list that says what each is. */
-    subject: string;
-    at: string;
-}
-export declare function listRefs(tenant: string, scope: string, kind: "heads" | "tags"): RefInfo[];
-/**
- * The commit a restore means by `to`, on main's history:
- *
- *   a sha or a prefix of one      that commit
- *   a branch or tag name          where it points
- *   an ISO date or time           the last commit on main at or before it
- *   "3d", "12h", "90m", "2w"      the same, that long ago
- *
- * Null when nothing matches — before the first commit, or a name that is
- * not there. Throws on a `to` that cannot be any of these, so a typo is a
- * 400 rather than a silent "nothing found".
- */
-export declare function resolveRestorePoint(tenant: string, scope: string, to: string, now?: number): {
-    sha: string;
-    at: string;
-    by: string;
-    message: string;
-} | null;
-/** The files at a commit, for a browser or a deploy. */
-export declare function listTree(tenant: string, scope: string, ref?: string): {
-    path: string;
-    mode: string;
-}[];
-export declare function readBlob(tenant: string, scope: string, ref: string, p: string): string | null;
-/** The whole tree at a ref as deploy files — what a push turns into a workspace. */
-export declare function filesAt(tenant: string, scope: string, ref: string): {
-    path: string;
-    content: string;
-}[];
-/**
- * What a ref would change on main: every file that differs, with both sides.
- * The branch's own commits are `listCommits({ ref })`; this is the net
- * effect, which is what a reviewer reads.
- */
-export declare function diffRefs(tenant: string, scope: string, base: string, head: string): RevisionFile[];
-/**
- * Merge a branch into main and return the new main. A fast-forward when it
- * is one; otherwise a merge commit whose tree is the BRANCH's — the branch
- * is what the person reviewed and chose, and a three-way textual merge of
- * markdown with no one to resolve conflicts would deploy text nobody wrote.
- * Both parents are recorded, so history shows the merge for what it was.
- */
-export declare function mergeBranch(tenant: string, scope: string, branch: string, meta?: {
-    by?: string;
-}): {
-    sha: string;
-    fastForward: boolean;
-};
-export declare function deleteBranch(tenant: string, scope: string, branch: string): void;
-/** Push main to another remote — a GitHub or GitLab mirror. Blocking; callers
- *  run it off the request path. The token never touches disk: it is in the
- *  URL for this one process and nowhere else. */
-export declare function pushMirror(tenant: string, scope: string, url: string): {
-    ok: boolean;
-    detail: string;
-};
-/**
- * Where the compiled pre-receive check is, found on disk rather than through
- * require.resolve — a bundler rewrites require.resolve("pkg") into a module
- * id, and the hook was once told to run a script called "51113". Searched
- * from the working directory upward: the monorepo layout, then an installed
- * package. Empty when there is no compiled check (a dev server on the source
- * tree), in which case a push is checked at deploy instead of refused — the
- * same rules, one step later.
- */
-export declare function hookScriptPath(): string;
-/**
- * The pre-receive hook: a push that fails the deploy checks is refused with
- * the errors in the pusher's terminal, instead of accepted and then not
- * deployed. The hook shells out to node with the compiled check, so it runs
- * the same rules as a dashboard deploy; which node and which script are
- * passed in the environment by the HTTP route, because a hook inherits git's
- * environment and nothing else.
- */
-export declare function installHooks(dir: string): void;
-export { type DiffOp };

package/dist/src/gitrepo.js

@@ -1,404 +0,0 @@
-// A git repository per workspace — the platform as the remote.
-//
-//   git remote add foldrun https://app.foldrun.io/git/<tenant>/<workspace>.git
-//   git push foldrun main          → deploys, commit on record
-//   git clone …/<workspace>.git    → the workspace, with its whole history
-//
-// One bare repository per workspace on the data volume. Every change the
-// platform makes — a dashboard save, a deploy, a deletion — is a commit into
-// it, made with git's own plumbing against a scratch index so no working copy
-// is ever kept. Every change a person makes is a push into it. So there is
-// one history, it is real git, and anyone can take it away with `git clone`.
-//
-// This deliberately stops at being a remote. Pull requests, reviews and
-// issues are a forge, which is a product; GitHub and GitLab remain a fine
-// mirror for anyone who wants that on top.
-//
-// history.ts delegates here when a repository exists, so the History page,
-// the per-file panel and Observe's eval attribution all read git without
-// knowing it. The journal it kept before stays as the fallback for an install
-// without a git binary.
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { dataRoot } from "./paths.js";
-const SAFE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/;
-const safe = (v, what) => {
-    if (!SAFE.test(v))
-        throw new Error(`illegal ${what}: ${v}`);
-    return v;
-};
-/** Where a workspace's bare repository lives. `@library` is the account shelf. */
-export function repoDir(tenant, scope) {
-    safe(tenant, "tenant");
-    const name = scope === "@library" ? "_library" : safe(scope, "workspace");
-    return path.join(dataRoot(), tenant, ".git", `${name}.git`);
-}
-let gitChecked = null;
-/** Is there a git binary? Checked once; an install without one keeps the journal. */
-export function gitAvailable() {
-    if (gitChecked === null) {
-        gitChecked = spawnSync("git", ["--version"], { stdio: "ignore" }).status === 0;
-    }
-    return gitChecked;
-}
-function git(dir, args, opts = {}) {
-    const r = spawnSync("git", ["--git-dir", dir, ...args], {
-        input: opts.input,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0", ...opts.env },
-        maxBuffer: 64 * 1024 * 1024,
-    });
-    if (r.status !== 0) {
-        throw new Error(`git ${args[0]} failed: ${(r.stderr?.toString() ?? "").trim().slice(0, 500)}`);
-    }
-    return r.stdout.toString();
-}
-export function repoExists(tenant, scope) {
-    return fs.existsSync(path.join(repoDir(tenant, scope), "HEAD"));
-}
-/** Create the repository if it is not there. Idempotent. */
-export function ensureRepo(tenant, scope) {
-    const dir = repoDir(tenant, scope);
-    if (!fs.existsSync(path.join(dir, "HEAD"))) {
-        fs.mkdirSync(path.dirname(dir), { recursive: true });
-        spawnSync("git", ["init", "--bare", "--quiet", "--initial-branch=main", dir], { stdio: "ignore" });
-        // Pushes over HTTP need this; it is the one config a bare remote wants.
-        git(dir, ["config", "http.receivepack", "true"]);
-    }
-    installHooks(dir);
-    return dir;
-}
-export function headSha(tenant, scope, ref = "refs/heads/main") {
-    if (!repoExists(tenant, scope))
-        return null;
-    const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "rev-parse", "--verify", "--quiet", ref]);
-    return r.status === 0 ? r.stdout.toString().trim() : null;
-}
-/**
- * Apply a change set as one commit on main, using plumbing against a scratch
- * index seeded from HEAD. No working copy, no checkout: each changed path is
- * hashed straight from its content into the object store.
- *
- * Returns the new commit, or null when the tree did not change.
- */
-export function commitChanges(tenant, scope, files, meta = {}) {
-    const dir = ensureRepo(tenant, scope);
-    const parent = headSha(tenant, scope);
-    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-index-"));
-    const index = path.join(scratch, "index");
-    // update-index insists on a work tree even when every entry arrives as
-    // --cacheinfo and nothing on disk is read. The scratch directory is one.
-    const env = { GIT_INDEX_FILE: index, GIT_WORK_TREE: scratch };
-    try {
-        if (parent)
-            git(dir, ["read-tree", parent], { env });
-        for (const f of files) {
-            if (f.after === null) {
-                if (parent)
-                    git(dir, ["update-index", "--force-remove", "--", f.path], { env });
-                continue;
-            }
-            const blob = git(dir, ["hash-object", "-w", "--stdin"], { input: f.after }).trim();
-            // Executable where code lives, matching what the writers chmod on disk.
-            const mode = /\.(py|sh|mjs|js|rb)$/.test(f.path) && /(^|\/)(scripts|tools)\//.test(f.path) ? "100755" : "100644";
-            git(dir, ["update-index", "--add", "--cacheinfo", `${mode},${blob},${f.path}`], { env });
-        }
-        const tree = git(dir, ["write-tree"], { env }).trim();
-        if (parent && git(dir, ["rev-parse", `${parent}^{tree}`]).trim() === tree)
-            return null;
-        const who = meta.by ?? "system";
-        const email = who.includes("@") ? who : `${who}@foldrun`;
-        const name = who.includes("@") ? who.split("@")[0] : who;
-        const date = meta.at ? new Date(meta.at).toISOString() : new Date().toISOString();
-        const commit = git(dir, ["commit-tree", tree, ...(parent ? ["-p", parent] : []), "-m", meta.message ?? describe(files)], {
-            env: {
-                GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-                GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-            },
-        }).trim();
-        git(dir, ["update-ref", "refs/heads/main", commit, ...(parent ? [parent] : [])]);
-        return commit;
-    }
-    finally {
-        fs.rmSync(scratch, { recursive: true, force: true });
-    }
-}
-function describe(files) {
-    if (files.length === 1) {
-        const f = files[0];
-        return `${f.before === null ? "created" : f.after === null ? "deleted" : "edited"} ${f.path}`;
-    }
-    return `changed ${files.length} files`;
-}
-// ------------------------------------------------------------------ reading
-const SEP = "";
-/** Commits on main, newest first, as the same summary the journal gave. */
-export function listCommits(tenant, scope, opts = {}) {
-    if (!headSha(tenant, scope, opts.ref))
-        return [];
-    const dir = repoDir(tenant, scope);
-    const out = git(dir, [
-        "log",
-        opts.ref ?? "refs/heads/main",
-        `--max-count=${opts.limit ?? 200}`,
-        `--format=%H${SEP}%aI${SEP}%ae${SEP}%s`,
-        "--name-only",
-        ...(opts.forPath ? ["--", opts.forPath] : []),
-    ]);
-    const rows = [];
-    let current = null;
-    for (const line of out.split("\n")) {
-        if (line.includes(SEP)) {
-            const [id, at, by, message] = line.split(SEP);
-            current = { id, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message, commit: id, paths: [] };
-            rows.push(current);
-        }
-        else if (line.trim() && current) {
-            current.paths.push(line.trim());
-        }
-    }
-    return rows;
-}
-/** One commit in full: every changed file with its before and after. */
-export function readCommit(tenant, scope, sha, forPath) {
-    if (!repoExists(tenant, scope) || !/^[0-9a-f]{4,40}$/.test(sha))
-        return null;
-    const dir = repoDir(tenant, scope);
-    const head = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${sha}^{commit}`]);
-    if (head.status !== 0)
-        return null;
-    const full = head.stdout.toString().trim();
-    const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%aI${SEP}%ae${SEP}%s`, full]).trim().split(SEP);
-    const hasParent = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${full}^`]).status === 0;
-    const names = git(dir, [
-        "diff-tree", "--no-commit-id", "--name-status", "-r", "--root", full,
-        ...(forPath ? ["--", forPath] : []),
-    ]);
-    const files = [];
-    for (const line of names.split("\n").filter(Boolean)) {
-        const [status, p] = line.split("\t");
-        const before = status === "A" || !hasParent ? null : blob(dir, `${full}^`, p);
-        const after = status === "D" ? null : blob(dir, full, p);
-        files.push({ path: p, before, after });
-    }
-    return {
-        id: full,
-        at,
-        by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by,
-        message: msg.join(SEP),
-        commit: full,
-        files,
-    };
-}
-function blob(dir, rev, p) {
-    const r = spawnSync("git", ["--git-dir", dir, "show", `${rev}:${p}`], { maxBuffer: 64 * 1024 * 1024 });
-    return r.status === 0 ? r.stdout.toString() : null;
-}
-export function listRefs(tenant, scope, kind) {
-    if (!repoExists(tenant, scope))
-        return [];
-    const out = git(repoDir(tenant, scope), [
-        "for-each-ref", `refs/${kind}`, "--sort=-committerdate",
-        `--format=%(refname:short)${SEP}%(objectname)${SEP}%(subject)${SEP}%(committerdate:iso-strict)`,
-    ]);
-    return out.split("\n").filter(Boolean).map((l) => {
-        const [name, sha, subject, at] = l.split(SEP);
-        return { name, sha, subject, at };
-    });
-}
-/**
- * The commit a restore means by `to`, on main's history:
- *
- *   a sha or a prefix of one      that commit
- *   a branch or tag name          where it points
- *   an ISO date or time           the last commit on main at or before it
- *   "3d", "12h", "90m", "2w"      the same, that long ago
- *
- * Null when nothing matches — before the first commit, or a name that is
- * not there. Throws on a `to` that cannot be any of these, so a typo is a
- * 400 rather than a silent "nothing found".
- */
-export function resolveRestorePoint(tenant, scope, to, now = Date.now()) {
-    const t = to.trim();
-    if (!t || t.startsWith("-"))
-        throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-    if (!headSha(tenant, scope))
-        return null;
-    const dir = repoDir(tenant, scope);
-    let sha = null;
-    const rel = /^(\d+)\s*(m|h|d|w)$/.exec(t);
-    const moment = rel
-        ? now - Number(rel[1]) * { m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 }[rel[2]]
-        : /^\d{4}-\d{2}-\d{2}/.test(t)
-            ? Date.parse(t)
-            : null;
-    if (moment !== null) {
-        if (Number.isNaN(moment))
-            throw Object.assign(new Error(`not a date: ${to}`), { status: 400 });
-        sha = git(dir, ["log", "-1", "--format=%H", `--until=@${Math.floor(moment / 1000)}`, "refs/heads/main"]).trim() || null;
-    }
-    else {
-        if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,120}$/.test(t))
-            throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-        for (const ref of [/^[0-9a-f]{4,40}$/.test(t) ? `${t}^{commit}` : null, `refs/heads/${t}^{commit}`, `refs/tags/${t}^{commit}`]) {
-            if (!ref)
-                continue;
-            const r = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", ref]);
-            if (r.status === 0) {
-                sha = r.stdout.toString().trim();
-                break;
-            }
-        }
-    }
-    if (!sha)
-        return null;
-    const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%cI${SEP}%ae${SEP}%s`, sha]).trim().split(SEP);
-    return { sha, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message: msg.join(SEP) };
-}
-/** The files at a commit, for a browser or a deploy. */
-export function listTree(tenant, scope, ref = "refs/heads/main") {
-    if (!headSha(tenant, scope, ref))
-        return [];
-    return git(repoDir(tenant, scope), ["ls-tree", "-r", "--format=%(objectmode) %(path)", ref])
-        .split("\n")
-        .filter(Boolean)
-        .map((l) => {
-        const [mode, ...rest] = l.split(" ");
-        return { mode, path: rest.join(" ") };
-    });
-}
-export function readBlob(tenant, scope, ref, p) {
-    if (!repoExists(tenant, scope))
-        return null;
-    return blob(repoDir(tenant, scope), ref, p);
-}
-/** The whole tree at a ref as deploy files — what a push turns into a workspace. */
-export function filesAt(tenant, scope, ref) {
-    const dir = repoDir(tenant, scope);
-    return listTree(tenant, scope, ref).flatMap((t) => {
-        const content = blob(dir, ref, t.path);
-        return content === null ? [] : [{ path: t.path, content }];
-    });
-}
-/**
- * What a ref would change on main: every file that differs, with both sides.
- * The branch's own commits are `listCommits({ ref })`; this is the net
- * effect, which is what a reviewer reads.
- */
-export function diffRefs(tenant, scope, base, head) {
-    if (!headSha(tenant, scope, base) || !headSha(tenant, scope, head))
-        return [];
-    const dir = repoDir(tenant, scope);
-    const out = git(dir, ["diff", "--name-status", `${base}...${head}`]);
-    return out.split("\n").filter(Boolean).map((line) => {
-        const [status, p] = line.split("\t");
-        return {
-            path: p,
-            before: status === "A" ? null : blob(dir, base, p),
-            after: status === "D" ? null : blob(dir, head, p),
-        };
-    });
-}
-/**
- * Merge a branch into main and return the new main. A fast-forward when it
- * is one; otherwise a merge commit whose tree is the BRANCH's — the branch
- * is what the person reviewed and chose, and a three-way textual merge of
- * markdown with no one to resolve conflicts would deploy text nobody wrote.
- * Both parents are recorded, so history shows the merge for what it was.
- */
-export function mergeBranch(tenant, scope, branch, meta = {}) {
-    const dir = repoDir(tenant, scope);
-    const main = headSha(tenant, scope);
-    const head = headSha(tenant, scope, `refs/heads/${safe(branch, "branch")}`);
-    if (!head)
-        throw new Error(`no branch "${branch}"`);
-    if (!main) {
-        git(dir, ["update-ref", "refs/heads/main", head]);
-        return { sha: head, fastForward: true };
-    }
-    const isAncestor = spawnSync("git", ["--git-dir", dir, "merge-base", "--is-ancestor", main, head]).status === 0;
-    if (isAncestor) {
-        git(dir, ["update-ref", "refs/heads/main", head, main]);
-        return { sha: head, fastForward: true };
-    }
-    const tree = git(dir, ["rev-parse", `${head}^{tree}`]).trim();
-    const who = meta.by ?? "foldrun";
-    const email = who.includes("@") ? who : `${who}@foldrun`;
-    const name = who.includes("@") ? who.split("@")[0] : who;
-    const date = new Date().toISOString();
-    const sha = git(dir, ["commit-tree", tree, "-p", main, "-p", head, "-m", `merge ${branch} into main`], {
-        env: {
-            GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-            GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-        },
-    }).trim();
-    git(dir, ["update-ref", "refs/heads/main", sha, main]);
-    return { sha, fastForward: false };
-}
-export function deleteBranch(tenant, scope, branch) {
-    if (branch === "main")
-        throw new Error("main is the default branch");
-    git(repoDir(tenant, scope), ["update-ref", "-d", `refs/heads/${safe(branch, "branch")}`]);
-}
-/** Push main to another remote — a GitHub or GitLab mirror. Blocking; callers
- *  run it off the request path. The token never touches disk: it is in the
- *  URL for this one process and nowhere else. */
-export function pushMirror(tenant, scope, url) {
-    if (!headSha(tenant, scope))
-        return { ok: false, detail: "nothing to push yet" };
-    const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "push", "--quiet", url, "+refs/heads/main:refs/heads/main"], {
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
-        timeout: 60_000,
-    });
-    const detail = (r.stderr?.toString() ?? "").trim()
-        // Never echo the URL back: it carries the token.
-        .replaceAll(url, "<mirror>")
-        .slice(0, 500);
-    return { ok: r.status === 0, detail: r.status === 0 ? "pushed" : detail || "push failed" };
-}
-/**
- * Where the compiled pre-receive check is, found on disk rather than through
- * require.resolve — a bundler rewrites require.resolve("pkg") into a module
- * id, and the hook was once told to run a script called "51113". Searched
- * from the working directory upward: the monorepo layout, then an installed
- * package. Empty when there is no compiled check (a dev server on the source
- * tree), in which case a push is checked at deploy instead of refused — the
- * same rules, one step later.
- */
-export function hookScriptPath() {
-    let dir = process.cwd();
-    for (let i = 0; i < 6; i++) {
-        for (const rel of ["packages/core/dist/src/git-hook.js", "node_modules/@foldrun/core/dist/src/git-hook.js"]) {
-            const candidate = path.join(dir, rel);
-            if (fs.existsSync(candidate))
-                return candidate;
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return "";
-}
-/**
- * The pre-receive hook: a push that fails the deploy checks is refused with
- * the errors in the pusher's terminal, instead of accepted and then not
- * deployed. The hook shells out to node with the compiled check, so it runs
- * the same rules as a dashboard deploy; which node and which script are
- * passed in the environment by the HTTP route, because a hook inherits git's
- * environment and nothing else.
- */
-export function installHooks(dir) {
-    const hooks = path.join(dir, "hooks");
-    fs.mkdirSync(hooks, { recursive: true });
-    const hook = path.join(hooks, "pre-receive");
-    const script = `#!/bin/sh
-# Installed by foldrun. Refuses a push to main whose tree fails the checks.
-[ -n "$FOLDRUN_HOOK_NODE" ] && [ -n "$FOLDRUN_HOOK_SCRIPT" ] || exit 0
-exec "$FOLDRUN_HOOK_NODE" "$FOLDRUN_HOOK_SCRIPT"
-`;
-    if (!fs.existsSync(hook) || fs.readFileSync(hook, "utf8") !== script) {
-        fs.writeFileSync(hook, script, { mode: 0o755 });
-    }
-}

package/dist/src/tar.d.ts

@@ -1,30 +0,0 @@
-export interface TarEntry {
-    path: string;
-    content: Buffer;
-}
-/**
- * Every regular file in a gzipped tarball.
- *
- * Directories, symlinks, and pax/global headers are skipped: a workspace is
- * files, and following a link out of the archive is exactly the thing a deploy
- * from an untrusted repository must not do.
- */
-export declare function readTarGz(gz: Buffer): TarEntry[];
-/**
- * Drop the single wrapper directory an archive is rooted at.
- *
- * GitHub tarballs are rooted at `owner-repo-<sha>/`, which is not part of
- * anyone's workspace. Stripped only when *every* entry shares one first
- * segment, so an archive that is already flat is left alone.
- */
-export declare function stripRoot(entries: TarEntry[]): TarEntry[];
-/**
- * Read a tarball as the file list a deploy ships.
- *
- * `subdir` picks a workspace living inside a larger repository — the common
- * case, since a repo usually holds more than one thing.
- */
-export declare function filesFromTarball(gz: Buffer, subdir?: string): {
-    path: string;
-    content: string;
-}[];

package/dist/src/tar.js

@@ -1,112 +0,0 @@
-// Reading a .tar.gz, so a deploy can come from a GitHub tarball.
-//
-// `GET /repos/{owner}/{repo}/tarball/{sha}` is one HTTP call and needs no git
-// binary, no clone, and no working copy on the server — which is the whole
-// reason a markdown workspace can deploy from a webhook in a few hundred
-// milliseconds. What it returns is a tar.gz, and Node has gzip but not tar.
-//
-// Deliberately dependency-free, for the same reason the cron parser is: tar is
-// 512-byte blocks with an octal size field, and a reader is shorter than the
-// argument about which library to add.
-import zlib from "node:zlib";
-import { trimSlashes } from "./paths.js";
-const BLOCK = 512;
-const str = (b, off, len) => {
-    const raw = b.subarray(off, off + len);
-    const end = raw.indexOf(0);
-    return raw.subarray(0, end === -1 ? raw.length : end).toString("utf8");
-};
-// Sizes are octal, space- or NUL-padded. GNU also writes base-256 for large
-// files, flagged by the high bit — irrelevant for markdown, but a silent
-// misparse would be worse than a clear refusal.
-function size(b, off) {
-    if (b[off] & 0x80)
-        throw new Error("tar: base-256 size field is not supported");
-    const raw = str(b, off, 12).trim();
-    return raw ? parseInt(raw, 8) : 0;
-}
-/**
- * Every regular file in a gzipped tarball.
- *
- * Directories, symlinks, and pax/global headers are skipped: a workspace is
- * files, and following a link out of the archive is exactly the thing a deploy
- * from an untrusted repository must not do.
- */
-export function readTarGz(gz) {
-    const buf = zlib.gunzipSync(gz);
-    const out = [];
-    let longName = null;
-    for (let off = 0; off + BLOCK <= buf.length;) {
-        const header = buf.subarray(off, off + BLOCK);
-        // Two consecutive zero blocks end the archive; one is enough to stop.
-        if (header.every((b) => b === 0))
-            break;
-        const name = str(header, 0, 100);
-        const bytes = size(header, 124);
-        const type = String.fromCharCode(header[156]) || "0";
-        const prefix = str(header, 345, 155);
-        off += BLOCK;
-        const body = buf.subarray(off, off + bytes);
-        off += Math.ceil(bytes / BLOCK) * BLOCK;
-        // GNU long name: the next header's name lives in this entry's body.
-        if (type === "L") {
-            longName = body.toString("utf8").replace(/\0+$/, "");
-            continue;
-        }
-        if (type !== "0" && type !== "\0") {
-            longName = null;
-            continue;
-        }
-        const full = longName ?? (prefix ? `${prefix}/${name}` : name);
-        longName = null;
-        if (full)
-            out.push({ path: full, content: Buffer.from(body) });
-    }
-    return out;
-}
-/**
- * Drop the single wrapper directory an archive is rooted at.
- *
- * GitHub tarballs are rooted at `owner-repo-<sha>/`, which is not part of
- * anyone's workspace. Stripped only when *every* entry shares one first
- * segment, so an archive that is already flat is left alone.
- */
-export function stripRoot(entries) {
-    if (entries.length === 0)
-        return entries;
-    const first = entries[0].path.split("/")[0];
-    if (!entries.every((e) => e.path.split("/")[0] === first && e.path.includes("/"))) {
-        return entries;
-    }
-    return entries.map((e) => ({ ...e, path: e.path.slice(first.length + 1) }));
-}
-/**
- * Read a tarball as the file list a deploy ships.
- *
- * `subdir` picks a workspace living inside a larger repository — the common
- * case, since a repo usually holds more than one thing.
- */
-export function filesFromTarball(gz, subdir = "") {
-    const prefix = trimSlashes(subdir, "both");
-    const out = [];
-    for (const entry of stripRoot(readTarGz(gz))) {
-        let rel = entry.path;
-        if (prefix) {
-            if (!rel.startsWith(`${prefix}/`))
-                continue;
-            rel = rel.slice(prefix.length + 1);
-        }
-        // A tarball is untrusted input: an entry can name anything at all, and
-        // `../` in an archive is the oldest way to write outside the destination.
-        if (rel.split("/").includes("..") || rel.startsWith("/"))
-            continue;
-        // AppleDouble sidecars. macOS `tar` writes a `._name` beside every file to
-        // carry metadata no other system wants; they are not part of anyone's
-        // workspace, and letting one through means a deploy rejected for shipping
-        // a file the author never wrote.
-        if ((rel.split("/").pop() ?? "").startsWith("._"))
-            continue;
-        out.push({ path: rel, content: entry.content.toString("utf8") });
-    }
-    return out;
-}