@foldrun/core 2.10.0 → 2.11.0

package/dist/src/evals.js

@@ -34,6 +34,7 @@ import { accountModelEnv, withModelEnv } from "./model-env.js";
 import { sdkEnv } from "./step-exec.js";
 import { platformModelEnv } from "./runner.js";
 import fs from "node:fs";
+import crypto from "node:crypto";
 import path from "node:path";
 import { deployedCommit } from "./deploy.js";
 import { latestRevisionId } from "./history.js";
@@ -137,6 +138,45 @@ export function parseEval(file, raw, defaults = {}) {
     }
     if (current)
         cases.push(current);
+    const trigger = data.trigger === "manual" ? "manual" : data.trigger === "runs" ? "runs" : "deploy";
+    const problems = [];
+    const sample = parseSample(data.sample, problems);
+    const improve = parseImprove(data.improve, problems);
+    if (trigger !== "runs") {
+        if (data.sample !== undefined)
+            problems.push("sample: only applies to an eval with trigger: runs — this one runs its cases");
+        if (data.improve !== undefined)
+            problems.push("improve: only applies to an eval with trigger: runs");
+    }
+    else {
+        // A grader reads what a run said; it never starts one, so a task has
+        // nothing to go to, and file:/run: would execute or read on the
+        // platform's host rather than in the run's sandbox.
+        for (const c of cases) {
+            if (c.task)
+                problems.push(`## ${c.name}: task: does nothing in a trigger: runs eval — it grades real runs, so each check is only an expect: list`);
+            for (const a of c.expect) {
+                if (a.type === "file" || a.type === "run")
+                    problems.push(`## ${c.name}: ${a.type}: cannot grade a finished run — use contains, not-contains or judge`);
+                // Graded on the platform's scheduler, over whatever a run said: a
+                // regular expression that backtracks would hold the scheduler with it.
+                if (a.type === "matches")
+                    problems.push(`## ${c.name}: matches: is not used to grade live runs — a regular expression over any run's output can stall the platform; use contains, not-contains or judge`);
+            }
+            if (c.expect.length === 0)
+                problems.push(`## ${c.name}: has no expect: lines, so it grades nothing`);
+        }
+        if (cases.length === 0)
+            problems.push("a grader needs at least one check — a `## <name>` section with an expect: list; with none it would pass every run");
+        // The pass budgets graded runs; this bounds the judges each one costs.
+        const judges = cases.reduce((n, c) => n + c.expect.filter((x) => x.type === "judge").length, 0);
+        if (judges > MAX_GRADER_JUDGES)
+            problems.push(`${judges} judge: lines — a grader asks at most ${MAX_GRADER_JUDGES} judges per run; fold related claims into one`);
+        if (data.live === true)
+            problems.push("live: does nothing in a trigger: runs eval — it never starts a run");
+        if (data.inputs === true)
+            problems.push("inputs: and trigger: runs cannot go together");
+    }
     return {
         name: data.name ?? file.replace(/\.md$/, ""),
         file,
@@ -144,12 +184,41 @@ export function parseEval(file, raw, defaults = {}) {
         flow: typeof data.flow === "string" ? data.flow : null,
         model: resolveModel(data.model ?? defaults.model ?? "fast"),
         effort: resolveEffort(data.effort ?? defaults.effort ?? "low"),
-        trigger: data.trigger === "manual" ? "manual" : "deploy",
+        trigger,
+        sample,
+        improve: trigger === "runs" ? improve : null,
+        problems,
         live: data.live === true,
         inputs: data.inputs === true,
         cases,
     };
 }
+/** Judges one graded run may cost — the grade pass counts runs, not calls. */
+export const MAX_GRADER_JUDGES = 5;
+/** `sample: 25`, `sample: "25%"` — percent of finished runs graded. */
+function parseSample(v, problems) {
+    if (v === undefined || v === null)
+        return 25;
+    const n = typeof v === "number" ? v : typeof v === "string" ? Number(v.trim().replace(/%$/, "")) : NaN;
+    if (!Number.isFinite(n) || n < 0 || n > 100) {
+        problems.push(`sample: ${String(v)} — a percent from 0 to 100 (25 grades about one run in four; 0 grades none on its own)`);
+        return 25;
+    }
+    return Math.round(n * 100) / 100;
+}
+/** `improve: true` (5), `improve: 3`, `improve: false`. */
+function parseImprove(v, problems) {
+    if (v === undefined || v === null || v === false)
+        return null;
+    if (v === true)
+        return 5;
+    const n = typeof v === "number" ? v : NaN;
+    if (!Number.isInteger(n) || n < 1 || n > 50) {
+        problems.push(`improve: ${String(v)} — true, or how many failed grades open a proposal (1 to 50)`);
+        return null;
+    }
+    return n;
+}
 export function listEvals(tenant, workspace) {
     const dir = path.join(workspaceDir(tenant, workspace), "evals");
     if (!fs.existsSync(dir))
@@ -158,7 +227,13 @@ export function listEvals(tenant, workspace) {
         .readdirSync(dir)
         .filter((f) => f.endsWith(".md"))
         .sort()
-        .map((f) => parseEval(f, fs.readFileSync(path.join(dir, f), "utf8"), judgeDefaults(tenant, workspace)));
+        .map((f) => {
+        const raw = fs.readFileSync(path.join(dir, f), "utf8");
+        // The version is taken from the same read the eval is parsed from, so
+        // a grade names the rubric that produced it even if the file changes
+        // while its judges answer.
+        return { ...parseEval(f, raw, judgeDefaults(tenant, workspace)), revision: crypto.createHash("sha256").update(raw).digest("hex").slice(0, 12) };
+    });
 }
 /** `judge:` from AGENTS.md, field by field: the workspace's model (or
  *  effort), else the account's — so a workspace that sets only an effort
@@ -386,32 +461,59 @@ function shell(command, cwd) {
 // LAST, after the reasoning: asked for it first, the judge committed before
 // it had looked, then argued the other way — "FAIL … which meets the
 // criterion" (vaza evals, 21 Oct 2026).
-async function judge(rubric, output, model, effort, env) {
+/** How long one judge may take before it is cut off: a verdict on one
+ *  sentence is seconds; a stalled model must not hold a grade pass. */
+export const JUDGE_TIMEOUT_MS = 120_000;
+/** One judge call: its words and what it cost (the SDK's result line). */
+export async function judgeCall(rubric, output, model, effort, env, 
+/** What the output was an answer to — a live run's task, so the judge
+ *  grades the reply against what was asked rather than in a vacuum. */
+context) {
     const prompt = `You are grading one piece of output against one criterion. ${JUDGE_VERDICT_INSTRUCTION}\n\n` +
-        `Criterion: ${rubric}\n\n<output>\n${output.slice(0, 20000)}\n</output>`;
+        `Criterion: ${rubric}\n\n` +
+        (context ? `<task>\n${context.slice(0, 4000)}\n</task>\n\n` : "") +
+        `<output>\n${output.slice(0, 20000)}\n</output>`;
     let text = "";
-    const q = query({
-        prompt,
-        options: {
-            model,
-            ...(effort ? { effort } : {}),
-            tools: [],
-            allowedTools: [],
-            settingSources: [],
-            strictMcpConfig: true,
-            env,
-            maxTurns: 1,
-        },
-    });
-    for await (const message of q) {
-        if (message.type === "assistant") {
-            for (const block of message.message.content) {
-                if (block.type === "text")
-                    text += block.text;
+    let costUsd = 0;
+    const abort = new AbortController();
+    const timer = setTimeout(() => abort.abort(), JUDGE_TIMEOUT_MS);
+    timer.unref?.();
+    try {
+        const q = query({
+            prompt,
+            options: {
+                model,
+                ...(effort ? { effort } : {}),
+                tools: [],
+                allowedTools: [],
+                settingSources: [],
+                strictMcpConfig: true,
+                env,
+                maxTurns: 1,
+                abortController: abort,
+            },
+        });
+        for await (const message of q) {
+            if (message.type === "assistant") {
+                for (const block of message.message.content) {
+                    if (block.type === "text")
+                        text += block.text;
+                }
+            }
+            else if (message.type === "result") {
+                costUsd = Number(message.total_cost_usd) || 0;
             }
         }
     }
-    return text.trim();
+    catch (err) {
+        if (abort.signal.aborted)
+            throw new Error(`the judge took longer than ${JUDGE_TIMEOUT_MS / 1000}s and was stopped`);
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    return { text: text.trim(), costUsd };
 }
 /**
  * The judge's environment: this process's, with the platform's model
@@ -425,7 +527,7 @@ export function judgeProcessEnv() {
     const live = Object.fromEntries(Object.entries(platformModelEnv()).filter(([, v]) => v !== undefined));
     return sdkEnv({ ...process.env, ...live });
 }
-async function checkAssertion(assertion, output, agentDir, model, effort, judgeEnv = () => ({ env: judgeProcessEnv() })) {
+export async function checkAssertion(assertion, output, agentDir, model, effort, judgeEnv = () => ({ env: judgeProcessEnv() })) {
     const hay = output.toLowerCase();
     switch (assertion.type) {
         case "contains": {
@@ -467,13 +569,16 @@ async function checkAssertion(assertion, output, agentDir, model, effort, judgeE
             catch (err) {
                 return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
             }
-            const text = await withModelEnv(m, (env) => judge(assertion.value, output, model, effort, env));
-            const { passed, detail } = judgeVerdict(text);
-            return { assertion, passed, detail };
+            const said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+            const { passed, detail } = judgeVerdict(said.text);
+            return { assertion, passed, detail, costUsd: said.costUsd };
         }
     }
 }
-export async function runEval(tenant, workspace, info) {
+export async function runEval(tenant, workspace, info, opts = {}) {
+    if (info.trigger === "runs") {
+        throw refuse(`${info.name} grades real runs (trigger: runs) — it has no cases to run; grade a run with POST …/evals/${info.name}/grade { run }`, 400);
+    }
     const startedAt = new Date().toISOString();
     const results = [];
     // Saved inputs carry no assertions: running them would start and bill a
@@ -485,6 +590,16 @@ export async function runEval(tenant, workspace, info) {
         let output = "";
         let error = null;
         let costUsd = 0;
+        let secs = null;
+        const stop = opts.beforeCase?.() ?? null;
+        if (stop) {
+            results.push({ name: testCase.name, task: testCase.task, runId: null, error: `not run — ${stop}`, passed: false, assertions: [], costUsd: 0, judgeCostUsd: 0, secs: null });
+            continue;
+        }
+        // A step forced onto the comparison's model: step-level, so it wins.
+        const force = (st) => opts.model && (!opts.agent || st.agent === opts.agent)
+            ? { ...st, model: opts.model, ...(opts.effort ? { effort: opts.effort } : {}) }
+            : st;
         try {
             let run;
             if (info.flow) {
@@ -492,27 +607,33 @@ export async function runEval(tenant, workspace, info) {
                 if (!flow || flow.steps.length === 0)
                     throw new Error(`flow ${info.flow} not found or empty`);
                 // The case's task reaches the first step; output passing carries it on.
-                const steps = flow.steps.map((s, i) => i === 0
+                const steps = flow.steps.map((s, i) => force(i === 0
                     ? { ...s, instruction: `${s.instruction}\n\n<run_task>\n${testCase.task}\n</run_task>` }
-                    : s);
+                    : s));
                 // Test unless the eval OR the flow says live: an eval that runs a
-                // flow written `live: true` was written by someone who knew.
-                run = await beginEvalRun(tenant, workspace, steps, `eval:${info.name}`, flow.model, flow.effort, !(info.live || flow.live));
+                // flow written `live: true` was written by someone who knew. A
+                // comparison is a test whatever they say.
+                run = await beginEvalRun(tenant, workspace, steps, `eval:${info.name}`, flow.model, flow.effort, opts.forceTest ? true : !(info.live || flow.live));
             }
             else {
                 if (!target)
                     throw new Error("this eval names neither an agent nor a flow");
-                run = await beginEvalRun(tenant, workspace, [{ agent: target, instruction: testCase.task, group: 1, optional: false }], `eval:${info.name}`, undefined, undefined, !info.live);
+                run = await beginEvalRun(tenant, workspace, [force({ agent: target, instruction: testCase.task, group: 1, optional: false })], `eval:${info.name}`, undefined, undefined, opts.forceTest ? true : !info.live);
             }
             runId = run.id;
             const finished = await waitForRun(tenant, workspace, run.id);
             if (!finished)
                 throw new Error("run disappeared");
+            // What the steps before a gate spent is spent: counted before the
+            // gate is refused, so a comparison's limit sees it.
+            costUsd = finished.steps.reduce((sum, s) => sum + (s.costUsd ?? 0), 0);
             if (finished.status === "awaiting-approval") {
                 throw new Error("this run pauses for approval — an eval cannot answer a human gate");
             }
             output = finished.steps.map((s) => s.result ?? "").join("\n\n");
-            costUsd = finished.steps.reduce((sum, s) => sum + (s.costUsd ?? 0), 0);
+            const from = Date.parse(finished.drivenAt ?? finished.startedAt);
+            const to = finished.finishedAt ? Date.parse(finished.finishedAt) : NaN;
+            secs = Number.isFinite(from) && Number.isFinite(to) ? Math.max(0, Math.round((to - from) / 100) / 10) : null;
             if (finished.status === "failed" && !output.trim()) {
                 // Quote the run's own last error. "Produced nothing" on a fresh
                 // workspace is almost always "secret X is not set" or a tool that
@@ -556,7 +677,10 @@ export async function runEval(tenant, workspace, info) {
             passed: !error && assertions.length > 0 && assertions.every((r) => r.passed),
             assertions,
             costUsd,
+            judgeCostUsd: Math.round(assertions.reduce((n, a) => n + (a.costUsd ?? 0), 0) * 1e6) / 1e6,
+            secs,
         });
+        opts.afterCase?.(results[results.length - 1]);
     }
     return {
         eval: info.name,
@@ -661,8 +785,9 @@ commit = null) {
     if (!stamp)
         return { ran: 0, skipped: "no revision to stamp the result with" };
     // Only the evals that asked to run on deploy — a `trigger: manual` eval is
-    // one a person runs on purpose, because it costs a whole flow run.
-    const evals = listEvals(tenant, workspace).filter((e) => e.trigger !== "manual" && !e.inputs);
+    // one a person runs on purpose, because it costs a whole flow run, and a
+    // `trigger: runs` one grades real runs and has no cases to run.
+    const evals = listEvals(tenant, workspace).filter((e) => e.trigger === "deploy" && !e.inputs);
     if (evals.length === 0)
         return { ran: 0, skipped: "no evals" };
     const dir = path.join(workspaceDir(tenant, workspace), "evals", ".results");

package/dist/src/flow-lint.js

@@ -12,6 +12,7 @@
 // blocked — flows still run, warnings are advisory.
 import { whenRowsPath } from "./store.js";
 import { timezoneProblem } from "./clock.js";
+import { FILTERABLE_TRIGGERS } from "./trigger-filter.js";
 /** What a `[[flow:x]]` step's options are called in a flow file, for the
  *  ones expandSubflows does not carry into the nested steps. */
 const SUBFLOW_DROPPED = [
@@ -209,6 +210,9 @@ export function lintFlow(flow, known) {
     if (flow.signature && !flow.signingSecret) {
         warnings.push({ step: null, message: `signature: ${flow.signature} needs \`signing_secret: \${NAME}\``, detail: "Every delivery will be refused until the secret is named and set in Settings → Secrets." });
     }
+    if (flow.filter != null && !FILTERABLE_TRIGGERS.includes(flow.trigger)) {
+        warnings.push({ step: null, message: `filter: only applies to a webhook, email, flow or storage trigger`, detail: `trigger: ${flow.trigger} delivers no payload to match, so the filter does nothing here.` });
+    }
     if (flow.signature && flow.trigger !== "webhook") {
         warnings.push({ step: null, message: "signature: only applies to trigger: webhook", detail: "Inbox and other triggers do not carry a provider signature; the line does nothing here." });
     }

package/dist/src/frontmatter-fields.js

@@ -113,6 +113,7 @@ const FLOW = [
     { key: "url", type: "string", help: "trigger: watch — the page watched" },
     { key: "every", type: ["string", "number"], help: "trigger: watch — how often" },
     { key: "path", type: "string", help: "trigger: storage — the prefix under storage/" },
+    { key: "filter", type: "object", validated: true, help: "webhook, email, flow or storage trigger: the fields a delivery must have to start a run — e.g. {action: [opened], sender: {type: {not_in: [Bot]}}}" },
     { key: "idempotency", type: "string", help: "a header name, or body:<field>, that marks a repeat delivery" },
     { key: "debounce", type: ["string", "number"], help: "wait for a burst to end" },
     { key: "throttle", type: ["string", "number"], help: "at most one run per window" },
@@ -166,7 +167,9 @@ const EVAL = [
     { key: "flow", type: "string", help: "or the flow" },
     { key: "model", type: "string", help: "the judge's model" },
     { key: "effort", type: "string", values: EFFORT_LEVELS, help: "the judge's effort" },
-    { key: "trigger", type: "string", values: ["deploy", "manual"], help: "deploy (default) | manual; anything else is deploy" },
+    { key: "trigger", type: "string", values: ["deploy", "manual", "runs"], help: "deploy (default) | manual | runs — runs: grade real finished runs of the agent or flow instead of running cases" },
+    { key: "sample", type: ["number", "string"], validated: true, help: "trigger: runs — the share of finished runs graded, 0 to 100 percent (default 25)" },
+    { key: "improve", type: ["boolean", "number"], validated: true, help: "trigger: runs — true (or a count, default 5): propose a fix once that many graded runs failed" },
     { key: "live", type: "boolean", help: "true: real calls" },
     { key: "inputs", type: "boolean", help: "true: cases carry inputs" },
 ];

package/dist/src/git-hook.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/git-hook.js

@@ -0,0 +1,70 @@
+// The pre-receive check, run by git inside a push.
+//
+// git feeds "<old> <new> <ref>" lines on stdin. For a push to main, read the
+// tree at the new commit straight from the object store and run the deploy
+// checks on it. Any issue: print them and exit non-zero — the push is refused
+// and the person sees exactly what a dashboard deploy would have told them,
+// in their terminal, before anything changed.
+//
+// Runs as its own process under git's environment. GIT_DIR is set by git.
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { deployIssues, runsInFlight } from "./deploy.js";
+const dir = process.env.GIT_DIR;
+if (!dir)
+    process.exit(0);
+// `_library.git` is the account shelf, not a workspace: it holds tools,
+// skills and knowledge and has no agents by definition. The workspace rules
+// refused every push to it with "no agents". Its sync (syncLibraryFromTree)
+// validates what it accepts on receive; nothing here to add yet.
+// Inside a hook git sets GIT_DIR relative to the repo ("."), so resolve it
+// against the cwd before asking for its name.
+if (path.basename(path.resolve(process.cwd(), dir)) === "_library.git")
+    process.exit(0);
+const input = fs.readFileSync(0, "utf8");
+const git = (args) => {
+    const r = spawnSync("git", ["--git-dir", dir, ...args], { maxBuffer: 64 * 1024 * 1024 });
+    return r.status === 0 ? r.stdout.toString() : null;
+};
+// The client is gone by the time the deploy runs, so this is the only moment
+// a person can be told their push will not take effect yet. A warning, not a
+// refusal: the commit is fine and the scheduler applies it when the runs end.
+const here = path.basename(path.resolve(process.cwd(), dir));
+if (here.endsWith(".git")) {
+    const workspace = here.slice(0, -4);
+    const tenant = path.basename(path.resolve(process.cwd(), dir, "..", ".."));
+    try {
+        const live = runsInFlight(tenant, workspace);
+        if (live.length) {
+            process.stderr.write(`\nfoldrun: ${live.length} run${live.length === 1 ? " is" : "s are"} in flight, so this push is not live yet.\n` +
+                `  It is on main and will be applied automatically when they finish.\n\n`);
+        }
+    }
+    catch {
+        // A warning that cannot be computed must never fail a push.
+    }
+}
+let refused = false;
+for (const line of input.split("\n").filter(Boolean)) {
+    const [, newSha, ref] = line.split(" ");
+    if (ref !== "refs/heads/main" || /^0+$/.test(newSha))
+        continue;
+    const tree = git(["ls-tree", "-r", "--name-only", newSha]) ?? "";
+    const files = tree
+        .split("\n")
+        .filter(Boolean)
+        .flatMap((p) => {
+        const content = git(["show", `${newSha}:${p}`]);
+        return content === null ? [] : [{ path: p, content }];
+    });
+    const issues = deployIssues(files);
+    if (issues.length) {
+        refused = true;
+        process.stderr.write(`\nfoldrun: refusing this push — ${issues.length} problem${issues.length === 1 ? "" : "s"} the checks would have stopped at deploy:\n`);
+        for (const i of issues)
+            process.stderr.write(`  ${i.where}: ${i.message}\n`);
+        process.stderr.write(`\nFix and push again. (foldrun check runs the same rules locally.)\n\n`);
+    }
+}
+process.exit(refused ? 1 : 0);

package/dist/src/git.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The secret a repository signs its pushes with.
+ *
+ * Derived rather than stored, exactly like a flow's webhook token: HMAC of the
+ * workspace's identity under the install key. Nothing new to persist, unique
+ * per workspace, and rotating FOLDRUN_SECRET_KEY invalidates every connection
+ * at once.
+ */
+export declare function gitSecret(tenant: string, workspace: string): string;
+export declare function gitHookPath(tenant: string, workspace: string): string;
+/**
+ * Whether a request really came from the repository it claims to.
+ *
+ * Compared in constant time: a byte-by-byte early return leaks the expected
+ * signature to anyone willing to time enough requests. The raw body is
+ * required — re-serializing parsed JSON changes bytes GitHub signed.
+ */
+export declare function verifySignature(secret: string, rawBody: string, header: string | null): boolean;
+export interface PushEvent {
+    repo: string;
+    /** Full ref, e.g. refs/heads/main. */
+    ref: string;
+    branch: string;
+    commit: string;
+    message: string | null;
+    pusher: string | null;
+}
+/** What we need out of a GitHub push payload, or null if it isn't one. */
+export declare function parsePush(payload: unknown): PushEvent | null;
+/**
+ * The repository at one commit, as a gzipped tarball.
+ *
+ * A token is only needed for a private repository. It is read from the
+ * environment rather than taken as an argument so a caller cannot be tricked
+ * into forwarding one somewhere else.
+ */
+export declare function fetchTarball(repo: string, commit: string): Promise<Buffer>;

package/dist/src/git.js

@@ -0,0 +1,101 @@
+// git push → deployed.
+//
+// A workspace is markdown, so there is no build to run: a push is a fetch of
+// the tree at that commit, a check, and a swap. This module is the GitHub half
+// — the secret a repository signs with, the payload shape, and pulling the
+// tarball. `deploy.ts` decides whether the result is allowed to go live.
+//
+// The tarball, not a clone: one HTTP call, no git binary, no working copy kept
+// on the server. A markdown workspace is a few hundred kilobytes.
+import crypto from "node:crypto";
+import { installKey } from "./webhook.js";
+/** GitHub refuses to fetch anything larger, and neither should we. */
+const MAX_TARBALL = 25 * 1024 * 1024;
+/**
+ * The secret a repository signs its pushes with.
+ *
+ * Derived rather than stored, exactly like a flow's webhook token: HMAC of the
+ * workspace's identity under the install key. Nothing new to persist, unique
+ * per workspace, and rotating FOLDRUN_SECRET_KEY invalidates every connection
+ * at once.
+ */
+export function gitSecret(tenant, workspace) {
+    return crypto
+        .createHmac("sha256", installKey())
+        .update(`git/${tenant}/${workspace}`)
+        .digest("hex");
+}
+export function gitHookPath(tenant, workspace) {
+    return `/api/git/${tenant}/${workspace}`;
+}
+/**
+ * Whether a request really came from the repository it claims to.
+ *
+ * Compared in constant time: a byte-by-byte early return leaks the expected
+ * signature to anyone willing to time enough requests. The raw body is
+ * required — re-serializing parsed JSON changes bytes GitHub signed.
+ */
+export function verifySignature(secret, rawBody, header) {
+    if (!header)
+        return false;
+    const expected = `sha256=${crypto.createHmac("sha256", secret).update(rawBody).digest("hex")}`;
+    const a = Buffer.from(expected);
+    const b = Buffer.from(header);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+/** What we need out of a GitHub push payload, or null if it isn't one. */
+export function parsePush(payload) {
+    if (!payload || typeof payload !== "object")
+        return null;
+    const p = payload;
+    const repo = p.repository?.full_name;
+    const ref = p.ref;
+    const commit = p.after;
+    if (typeof repo !== "string" || typeof ref !== "string" || typeof commit !== "string") {
+        return null;
+    }
+    // A deleted branch reports all zeros and ships no tree.
+    if (/^0+$/.test(commit))
+        return null;
+    return {
+        repo,
+        ref,
+        branch: ref.replace(/^refs\/heads\//, ""),
+        commit,
+        message: typeof p.head_commit?.message === "string" ? p.head_commit.message : null,
+        pusher: typeof p.pusher?.name === "string" ? p.pusher.name : null,
+    };
+}
+/**
+ * The repository at one commit, as a gzipped tarball.
+ *
+ * A token is only needed for a private repository. It is read from the
+ * environment rather than taken as an argument so a caller cannot be tricked
+ * into forwarding one somewhere else.
+ */
+export async function fetchTarball(repo, commit) {
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo))
+        throw new Error(`refusing to fetch "${repo}"`);
+    if (!/^[0-9a-f]{7,40}$/i.test(commit))
+        throw new Error(`refusing to fetch commit "${commit}"`);
+    const headers = {
+        accept: "application/vnd.github+json",
+        "user-agent": "foldrun",
+        "x-github-api-version": "2022-11-28",
+    };
+    const token = process.env.GITHUB_TOKEN;
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    const res = await fetch(`https://api.github.com/repos/${repo}/tarball/${commit}`, { headers });
+    if (!res.ok) {
+        throw new Error(`GitHub returned ${res.status} for ${repo}@${commit.slice(0, 8)}` +
+            (res.status === 404 && !token
+                ? " — a private repository needs GITHUB_TOKEN set on the server"
+                : ""));
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (buf.length > MAX_TARBALL) {
+        throw new Error(`${repo} is ${Math.round(buf.length / 1e6)}MB — too large to deploy`);
+    }
+    return buf;
+}