@foldrun/core 2.11.0 → 2.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "2.11.0",
+  "version": "2.11.1",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -42,7 +42,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
     "prepare": "npm run build && (test ! -f .githooks/install.sh || sh .githooks/install.sh)",
     "prepublishOnly": "npm run build",
     "test": "FOLDRUN_DATA=$(mktemp -d /tmp/foldrun-test-XXXXXX) node --test *.test.ts $(ls tests/*.test.ts | grep -v e2e)",

package/dist/src/git-hook.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/src/git-hook.js

@@ -1,70 +0,0 @@
-// The pre-receive check, run by git inside a push.
-//
-// git feeds "<old> <new> <ref>" lines on stdin. For a push to main, read the
-// tree at the new commit straight from the object store and run the deploy
-// checks on it. Any issue: print them and exit non-zero — the push is refused
-// and the person sees exactly what a dashboard deploy would have told them,
-// in their terminal, before anything changed.
-//
-// Runs as its own process under git's environment. GIT_DIR is set by git.
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { deployIssues, runsInFlight } from "./deploy.js";
-const dir = process.env.GIT_DIR;
-if (!dir)
-    process.exit(0);
-// `_library.git` is the account shelf, not a workspace: it holds tools,
-// skills and knowledge and has no agents by definition. The workspace rules
-// refused every push to it with "no agents". Its sync (syncLibraryFromTree)
-// validates what it accepts on receive; nothing here to add yet.
-// Inside a hook git sets GIT_DIR relative to the repo ("."), so resolve it
-// against the cwd before asking for its name.
-if (path.basename(path.resolve(process.cwd(), dir)) === "_library.git")
-    process.exit(0);
-const input = fs.readFileSync(0, "utf8");
-const git = (args) => {
-    const r = spawnSync("git", ["--git-dir", dir, ...args], { maxBuffer: 64 * 1024 * 1024 });
-    return r.status === 0 ? r.stdout.toString() : null;
-};
-// The client is gone by the time the deploy runs, so this is the only moment
-// a person can be told their push will not take effect yet. A warning, not a
-// refusal: the commit is fine and the scheduler applies it when the runs end.
-const here = path.basename(path.resolve(process.cwd(), dir));
-if (here.endsWith(".git")) {
-    const workspace = here.slice(0, -4);
-    const tenant = path.basename(path.resolve(process.cwd(), dir, "..", ".."));
-    try {
-        const live = runsInFlight(tenant, workspace);
-        if (live.length) {
-            process.stderr.write(`\nfoldrun: ${live.length} run${live.length === 1 ? " is" : "s are"} in flight, so this push is not live yet.\n` +
-                `  It is on main and will be applied automatically when they finish.\n\n`);
-        }
-    }
-    catch {
-        // A warning that cannot be computed must never fail a push.
-    }
-}
-let refused = false;
-for (const line of input.split("\n").filter(Boolean)) {
-    const [, newSha, ref] = line.split(" ");
-    if (ref !== "refs/heads/main" || /^0+$/.test(newSha))
-        continue;
-    const tree = git(["ls-tree", "-r", "--name-only", newSha]) ?? "";
-    const files = tree
-        .split("\n")
-        .filter(Boolean)
-        .flatMap((p) => {
-        const content = git(["show", `${newSha}:${p}`]);
-        return content === null ? [] : [{ path: p, content }];
-    });
-    const issues = deployIssues(files);
-    if (issues.length) {
-        refused = true;
-        process.stderr.write(`\nfoldrun: refusing this push — ${issues.length} problem${issues.length === 1 ? "" : "s"} the checks would have stopped at deploy:\n`);
-        for (const i of issues)
-            process.stderr.write(`  ${i.where}: ${i.message}\n`);
-        process.stderr.write(`\nFix and push again. (foldrun check runs the same rules locally.)\n\n`);
-    }
-}
-process.exit(refused ? 1 : 0);

package/dist/src/git.d.ts

@@ -1,37 +0,0 @@
-/**
- * The secret a repository signs its pushes with.
- *
- * Derived rather than stored, exactly like a flow's webhook token: HMAC of the
- * workspace's identity under the install key. Nothing new to persist, unique
- * per workspace, and rotating FOLDRUN_SECRET_KEY invalidates every connection
- * at once.
- */
-export declare function gitSecret(tenant: string, workspace: string): string;
-export declare function gitHookPath(tenant: string, workspace: string): string;
-/**
- * Whether a request really came from the repository it claims to.
- *
- * Compared in constant time: a byte-by-byte early return leaks the expected
- * signature to anyone willing to time enough requests. The raw body is
- * required — re-serializing parsed JSON changes bytes GitHub signed.
- */
-export declare function verifySignature(secret: string, rawBody: string, header: string | null): boolean;
-export interface PushEvent {
-    repo: string;
-    /** Full ref, e.g. refs/heads/main. */
-    ref: string;
-    branch: string;
-    commit: string;
-    message: string | null;
-    pusher: string | null;
-}
-/** What we need out of a GitHub push payload, or null if it isn't one. */
-export declare function parsePush(payload: unknown): PushEvent | null;
-/**
- * The repository at one commit, as a gzipped tarball.
- *
- * A token is only needed for a private repository. It is read from the
- * environment rather than taken as an argument so a caller cannot be tricked
- * into forwarding one somewhere else.
- */
-export declare function fetchTarball(repo: string, commit: string): Promise<Buffer>;

package/dist/src/git.js

@@ -1,101 +0,0 @@
-// git push → deployed.
-//
-// A workspace is markdown, so there is no build to run: a push is a fetch of
-// the tree at that commit, a check, and a swap. This module is the GitHub half
-// — the secret a repository signs with, the payload shape, and pulling the
-// tarball. `deploy.ts` decides whether the result is allowed to go live.
-//
-// The tarball, not a clone: one HTTP call, no git binary, no working copy kept
-// on the server. A markdown workspace is a few hundred kilobytes.
-import crypto from "node:crypto";
-import { installKey } from "./webhook.js";
-/** GitHub refuses to fetch anything larger, and neither should we. */
-const MAX_TARBALL = 25 * 1024 * 1024;
-/**
- * The secret a repository signs its pushes with.
- *
- * Derived rather than stored, exactly like a flow's webhook token: HMAC of the
- * workspace's identity under the install key. Nothing new to persist, unique
- * per workspace, and rotating FOLDRUN_SECRET_KEY invalidates every connection
- * at once.
- */
-export function gitSecret(tenant, workspace) {
-    return crypto
-        .createHmac("sha256", installKey())
-        .update(`git/${tenant}/${workspace}`)
-        .digest("hex");
-}
-export function gitHookPath(tenant, workspace) {
-    return `/api/git/${tenant}/${workspace}`;
-}
-/**
- * Whether a request really came from the repository it claims to.
- *
- * Compared in constant time: a byte-by-byte early return leaks the expected
- * signature to anyone willing to time enough requests. The raw body is
- * required — re-serializing parsed JSON changes bytes GitHub signed.
- */
-export function verifySignature(secret, rawBody, header) {
-    if (!header)
-        return false;
-    const expected = `sha256=${crypto.createHmac("sha256", secret).update(rawBody).digest("hex")}`;
-    const a = Buffer.from(expected);
-    const b = Buffer.from(header);
-    return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
-/** What we need out of a GitHub push payload, or null if it isn't one. */
-export function parsePush(payload) {
-    if (!payload || typeof payload !== "object")
-        return null;
-    const p = payload;
-    const repo = p.repository?.full_name;
-    const ref = p.ref;
-    const commit = p.after;
-    if (typeof repo !== "string" || typeof ref !== "string" || typeof commit !== "string") {
-        return null;
-    }
-    // A deleted branch reports all zeros and ships no tree.
-    if (/^0+$/.test(commit))
-        return null;
-    return {
-        repo,
-        ref,
-        branch: ref.replace(/^refs\/heads\//, ""),
-        commit,
-        message: typeof p.head_commit?.message === "string" ? p.head_commit.message : null,
-        pusher: typeof p.pusher?.name === "string" ? p.pusher.name : null,
-    };
-}
-/**
- * The repository at one commit, as a gzipped tarball.
- *
- * A token is only needed for a private repository. It is read from the
- * environment rather than taken as an argument so a caller cannot be tricked
- * into forwarding one somewhere else.
- */
-export async function fetchTarball(repo, commit) {
-    if (!/^[\w.-]+\/[\w.-]+$/.test(repo))
-        throw new Error(`refusing to fetch "${repo}"`);
-    if (!/^[0-9a-f]{7,40}$/i.test(commit))
-        throw new Error(`refusing to fetch commit "${commit}"`);
-    const headers = {
-        accept: "application/vnd.github+json",
-        "user-agent": "foldrun",
-        "x-github-api-version": "2022-11-28",
-    };
-    const token = process.env.GITHUB_TOKEN;
-    if (token)
-        headers.authorization = `Bearer ${token}`;
-    const res = await fetch(`https://api.github.com/repos/${repo}/tarball/${commit}`, { headers });
-    if (!res.ok) {
-        throw new Error(`GitHub returned ${res.status} for ${repo}@${commit.slice(0, 8)}` +
-            (res.status === 404 && !token
-                ? " — a private repository needs GITHUB_TOKEN set on the server"
-                : ""));
-    }
-    const buf = Buffer.from(await res.arrayBuffer());
-    if (buf.length > MAX_TARBALL) {
-        throw new Error(`${repo} is ${Math.round(buf.length / 1e6)}MB — too large to deploy`);
-    }
-    return buf;
-}

package/dist/src/gitrepo.d.ts

@@ -1,113 +0,0 @@
-import type { DiffOp, Revision, RevisionFile, RevisionSummary } from "./history.ts";
-/** Where a workspace's bare repository lives. `@library` is the account shelf. */
-export declare function repoDir(tenant: string, scope: string): string;
-/** Is there a git binary? Checked once; an install without one keeps the journal. */
-export declare function gitAvailable(): boolean;
-export declare function repoExists(tenant: string, scope: string): boolean;
-/** Create the repository if it is not there. Idempotent. */
-export declare function ensureRepo(tenant: string, scope: string): string;
-export declare function headSha(tenant: string, scope: string, ref?: string): string | null;
-/**
- * Apply a change set as one commit on main, using plumbing against a scratch
- * index seeded from HEAD. No working copy, no checkout: each changed path is
- * hashed straight from its content into the object store.
- *
- * Returns the new commit, or null when the tree did not change.
- */
-export declare function commitChanges(tenant: string, scope: string, files: RevisionFile[], meta?: {
-    by?: string;
-    message?: string;
-    at?: string;
-}): string | null;
-/** Commits on main, newest first, as the same summary the journal gave. */
-export declare function listCommits(tenant: string, scope: string, opts?: {
-    forPath?: string;
-    limit?: number;
-    ref?: string;
-}): RevisionSummary[];
-/** One commit in full: every changed file with its before and after. */
-export declare function readCommit(tenant: string, scope: string, sha: string, forPath?: string): Revision | null;
-export interface RefInfo {
-    name: string;
-    sha: string;
-    /** Commit subject and time, for a branch list that says what each is. */
-    subject: string;
-    at: string;
-}
-export declare function listRefs(tenant: string, scope: string, kind: "heads" | "tags"): RefInfo[];
-/**
- * The commit a restore means by `to`, on main's history:
- *
- *   a sha or a prefix of one      that commit
- *   a branch or tag name          where it points
- *   an ISO date or time           the last commit on main at or before it
- *   "3d", "12h", "90m", "2w"      the same, that long ago
- *
- * Null when nothing matches — before the first commit, or a name that is
- * not there. Throws on a `to` that cannot be any of these, so a typo is a
- * 400 rather than a silent "nothing found".
- */
-export declare function resolveRestorePoint(tenant: string, scope: string, to: string, now?: number): {
-    sha: string;
-    at: string;
-    by: string;
-    message: string;
-} | null;
-/** The files at a commit, for a browser or a deploy. */
-export declare function listTree(tenant: string, scope: string, ref?: string): {
-    path: string;
-    mode: string;
-}[];
-export declare function readBlob(tenant: string, scope: string, ref: string, p: string): string | null;
-/** The whole tree at a ref as deploy files — what a push turns into a workspace. */
-export declare function filesAt(tenant: string, scope: string, ref: string): {
-    path: string;
-    content: string;
-}[];
-/**
- * What a ref would change on main: every file that differs, with both sides.
- * The branch's own commits are `listCommits({ ref })`; this is the net
- * effect, which is what a reviewer reads.
- */
-export declare function diffRefs(tenant: string, scope: string, base: string, head: string): RevisionFile[];
-/**
- * Merge a branch into main and return the new main. A fast-forward when it
- * is one; otherwise a merge commit whose tree is the BRANCH's — the branch
- * is what the person reviewed and chose, and a three-way textual merge of
- * markdown with no one to resolve conflicts would deploy text nobody wrote.
- * Both parents are recorded, so history shows the merge for what it was.
- */
-export declare function mergeBranch(tenant: string, scope: string, branch: string, meta?: {
-    by?: string;
-}): {
-    sha: string;
-    fastForward: boolean;
-};
-export declare function deleteBranch(tenant: string, scope: string, branch: string): void;
-/** Push main to another remote — a GitHub or GitLab mirror. Blocking; callers
- *  run it off the request path. The token never touches disk: it is in the
- *  URL for this one process and nowhere else. */
-export declare function pushMirror(tenant: string, scope: string, url: string): {
-    ok: boolean;
-    detail: string;
-};
-/**
- * Where the compiled pre-receive check is, found on disk rather than through
- * require.resolve — a bundler rewrites require.resolve("pkg") into a module
- * id, and the hook was once told to run a script called "51113". Searched
- * from the working directory upward: the monorepo layout, then an installed
- * package. Empty when there is no compiled check (a dev server on the source
- * tree), in which case a push is checked at deploy instead of refused — the
- * same rules, one step later.
- */
-export declare function hookScriptPath(): string;
-/**
- * The pre-receive hook: a push that fails the deploy checks is refused with
- * the errors in the pusher's terminal, instead of accepted and then not
- * deployed. The hook shells out to node with the compiled check, so it runs
- * the same rules as a dashboard deploy; which node and which script are
- * passed in the environment by the HTTP route, because a hook inherits git's
- * environment and nothing else.
- */
-export declare function installHooks(dir: string): void;
-export { type DiffOp };

package/dist/src/gitrepo.js

@@ -1,404 +0,0 @@
-// A git repository per workspace — the platform as the remote.
-//
-//   git remote add foldrun https://app.foldrun.io/git/<tenant>/<workspace>.git
-//   git push foldrun main          → deploys, commit on record
-//   git clone …/<workspace>.git    → the workspace, with its whole history
-//
-// One bare repository per workspace on the data volume. Every change the
-// platform makes — a dashboard save, a deploy, a deletion — is a commit into
-// it, made with git's own plumbing against a scratch index so no working copy
-// is ever kept. Every change a person makes is a push into it. So there is
-// one history, it is real git, and anyone can take it away with `git clone`.
-//
-// This deliberately stops at being a remote. Pull requests, reviews and
-// issues are a forge, which is a product; GitHub and GitLab remain a fine
-// mirror for anyone who wants that on top.
-//
-// history.ts delegates here when a repository exists, so the History page,
-// the per-file panel and Observe's eval attribution all read git without
-// knowing it. The journal it kept before stays as the fallback for an install
-// without a git binary.
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { dataRoot } from "./paths.js";
-const SAFE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/;
-const safe = (v, what) => {
-    if (!SAFE.test(v))
-        throw new Error(`illegal ${what}: ${v}`);
-    return v;
-};
-/** Where a workspace's bare repository lives. `@library` is the account shelf. */
-export function repoDir(tenant, scope) {
-    safe(tenant, "tenant");
-    const name = scope === "@library" ? "_library" : safe(scope, "workspace");
-    return path.join(dataRoot(), tenant, ".git", `${name}.git`);
-}
-let gitChecked = null;
-/** Is there a git binary? Checked once; an install without one keeps the journal. */
-export function gitAvailable() {
-    if (gitChecked === null) {
-        gitChecked = spawnSync("git", ["--version"], { stdio: "ignore" }).status === 0;
-    }
-    return gitChecked;
-}
-function git(dir, args, opts = {}) {
-    const r = spawnSync("git", ["--git-dir", dir, ...args], {
-        input: opts.input,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0", ...opts.env },
-        maxBuffer: 64 * 1024 * 1024,
-    });
-    if (r.status !== 0) {
-        throw new Error(`git ${args[0]} failed: ${(r.stderr?.toString() ?? "").trim().slice(0, 500)}`);
-    }
-    return r.stdout.toString();
-}
-export function repoExists(tenant, scope) {
-    return fs.existsSync(path.join(repoDir(tenant, scope), "HEAD"));
-}
-/** Create the repository if it is not there. Idempotent. */
-export function ensureRepo(tenant, scope) {
-    const dir = repoDir(tenant, scope);
-    if (!fs.existsSync(path.join(dir, "HEAD"))) {
-        fs.mkdirSync(path.dirname(dir), { recursive: true });
-        spawnSync("git", ["init", "--bare", "--quiet", "--initial-branch=main", dir], { stdio: "ignore" });
-        // Pushes over HTTP need this; it is the one config a bare remote wants.
-        git(dir, ["config", "http.receivepack", "true"]);
-    }
-    installHooks(dir);
-    return dir;
-}
-export function headSha(tenant, scope, ref = "refs/heads/main") {
-    if (!repoExists(tenant, scope))
-        return null;
-    const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "rev-parse", "--verify", "--quiet", ref]);
-    return r.status === 0 ? r.stdout.toString().trim() : null;
-}
-/**
- * Apply a change set as one commit on main, using plumbing against a scratch
- * index seeded from HEAD. No working copy, no checkout: each changed path is
- * hashed straight from its content into the object store.
- *
- * Returns the new commit, or null when the tree did not change.
- */
-export function commitChanges(tenant, scope, files, meta = {}) {
-    const dir = ensureRepo(tenant, scope);
-    const parent = headSha(tenant, scope);
-    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-index-"));
-    const index = path.join(scratch, "index");
-    // update-index insists on a work tree even when every entry arrives as
-    // --cacheinfo and nothing on disk is read. The scratch directory is one.
-    const env = { GIT_INDEX_FILE: index, GIT_WORK_TREE: scratch };
-    try {
-        if (parent)
-            git(dir, ["read-tree", parent], { env });
-        for (const f of files) {
-            if (f.after === null) {
-                if (parent)
-                    git(dir, ["update-index", "--force-remove", "--", f.path], { env });
-                continue;
-            }
-            const blob = git(dir, ["hash-object", "-w", "--stdin"], { input: f.after }).trim();
-            // Executable where code lives, matching what the writers chmod on disk.
-            const mode = /\.(py|sh|mjs|js|rb)$/.test(f.path) && /(^|\/)(scripts|tools)\//.test(f.path) ? "100755" : "100644";
-            git(dir, ["update-index", "--add", "--cacheinfo", `${mode},${blob},${f.path}`], { env });
-        }
-        const tree = git(dir, ["write-tree"], { env }).trim();
-        if (parent && git(dir, ["rev-parse", `${parent}^{tree}`]).trim() === tree)
-            return null;
-        const who = meta.by ?? "system";
-        const email = who.includes("@") ? who : `${who}@foldrun`;
-        const name = who.includes("@") ? who.split("@")[0] : who;
-        const date = meta.at ? new Date(meta.at).toISOString() : new Date().toISOString();
-        const commit = git(dir, ["commit-tree", tree, ...(parent ? ["-p", parent] : []), "-m", meta.message ?? describe(files)], {
-            env: {
-                GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-                GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-            },
-        }).trim();
-        git(dir, ["update-ref", "refs/heads/main", commit, ...(parent ? [parent] : [])]);
-        return commit;
-    }
-    finally {
-        fs.rmSync(scratch, { recursive: true, force: true });
-    }
-}
-function describe(files) {
-    if (files.length === 1) {
-        const f = files[0];
-        return `${f.before === null ? "created" : f.after === null ? "deleted" : "edited"} ${f.path}`;
-    }
-    return `changed ${files.length} files`;
-}
-// ------------------------------------------------------------------ reading
-const SEP = "";
-/** Commits on main, newest first, as the same summary the journal gave. */
-export function listCommits(tenant, scope, opts = {}) {
-    if (!headSha(tenant, scope, opts.ref))
-        return [];
-    const dir = repoDir(tenant, scope);
-    const out = git(dir, [
-        "log",
-        opts.ref ?? "refs/heads/main",
-        `--max-count=${opts.limit ?? 200}`,
-        `--format=%H${SEP}%aI${SEP}%ae${SEP}%s`,
-        "--name-only",
-        ...(opts.forPath ? ["--", opts.forPath] : []),
-    ]);
-    const rows = [];
-    let current = null;
-    for (const line of out.split("\n")) {
-        if (line.includes(SEP)) {
-            const [id, at, by, message] = line.split(SEP);
-            current = { id, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message, commit: id, paths: [] };
-            rows.push(current);
-        }
-        else if (line.trim() && current) {
-            current.paths.push(line.trim());
-        }
-    }
-    return rows;
-}
-/** One commit in full: every changed file with its before and after. */
-export function readCommit(tenant, scope, sha, forPath) {
-    if (!repoExists(tenant, scope) || !/^[0-9a-f]{4,40}$/.test(sha))
-        return null;
-    const dir = repoDir(tenant, scope);
-    const head = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${sha}^{commit}`]);
-    if (head.status !== 0)
-        return null;
-    const full = head.stdout.toString().trim();
-    const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%aI${SEP}%ae${SEP}%s`, full]).trim().split(SEP);
-    const hasParent = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${full}^`]).status === 0;
-    const names = git(dir, [
-        "diff-tree", "--no-commit-id", "--name-status", "-r", "--root", full,
-        ...(forPath ? ["--", forPath] : []),
-    ]);
-    const files = [];
-    for (const line of names.split("\n").filter(Boolean)) {
-        const [status, p] = line.split("\t");
-        const before = status === "A" || !hasParent ? null : blob(dir, `${full}^`, p);
-        const after = status === "D" ? null : blob(dir, full, p);
-        files.push({ path: p, before, after });
-    }
-    return {
-        id: full,
-        at,
-        by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by,
-        message: msg.join(SEP),
-        commit: full,
-        files,
-    };
-}
-function blob(dir, rev, p) {
-    const r = spawnSync("git", ["--git-dir", dir, "show", `${rev}:${p}`], { maxBuffer: 64 * 1024 * 1024 });
-    return r.status === 0 ? r.stdout.toString() : null;
-}
-export function listRefs(tenant, scope, kind) {
-    if (!repoExists(tenant, scope))
-        return [];
-    const out = git(repoDir(tenant, scope), [
-        "for-each-ref", `refs/${kind}`, "--sort=-committerdate",
-        `--format=%(refname:short)${SEP}%(objectname)${SEP}%(subject)${SEP}%(committerdate:iso-strict)`,
-    ]);
-    return out.split("\n").filter(Boolean).map((l) => {
-        const [name, sha, subject, at] = l.split(SEP);
-        return { name, sha, subject, at };
-    });
-}
-/**
- * The commit a restore means by `to`, on main's history:
- *
- *   a sha or a prefix of one      that commit
- *   a branch or tag name          where it points
- *   an ISO date or time           the last commit on main at or before it
- *   "3d", "12h", "90m", "2w"      the same, that long ago
- *
- * Null when nothing matches — before the first commit, or a name that is
- * not there. Throws on a `to` that cannot be any of these, so a typo is a
- * 400 rather than a silent "nothing found".
- */
-export function resolveRestorePoint(tenant, scope, to, now = Date.now()) {
-    const t = to.trim();
-    if (!t || t.startsWith("-"))
-        throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-    if (!headSha(tenant, scope))
-        return null;
-    const dir = repoDir(tenant, scope);
-    let sha = null;
-    const rel = /^(\d+)\s*(m|h|d|w)$/.exec(t);
-    const moment = rel
-        ? now - Number(rel[1]) * { m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 }[rel[2]]
-        : /^\d{4}-\d{2}-\d{2}/.test(t)
-            ? Date.parse(t)
-            : null;
-    if (moment !== null) {
-        if (Number.isNaN(moment))
-            throw Object.assign(new Error(`not a date: ${to}`), { status: 400 });
-        sha = git(dir, ["log", "-1", "--format=%H", `--until=@${Math.floor(moment / 1000)}`, "refs/heads/main"]).trim() || null;
-    }
-    else {
-        if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,120}$/.test(t))
-            throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-        for (const ref of [/^[0-9a-f]{4,40}$/.test(t) ? `${t}^{commit}` : null, `refs/heads/${t}^{commit}`, `refs/tags/${t}^{commit}`]) {
-            if (!ref)
-                continue;
-            const r = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", ref]);
-            if (r.status === 0) {
-                sha = r.stdout.toString().trim();
-                break;
-            }
-        }
-    }
-    if (!sha)
-        return null;
-    const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%cI${SEP}%ae${SEP}%s`, sha]).trim().split(SEP);
-    return { sha, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message: msg.join(SEP) };
-}
-/** The files at a commit, for a browser or a deploy. */
-export function listTree(tenant, scope, ref = "refs/heads/main") {
-    if (!headSha(tenant, scope, ref))
-        return [];
-    return git(repoDir(tenant, scope), ["ls-tree", "-r", "--format=%(objectmode) %(path)", ref])
-        .split("\n")
-        .filter(Boolean)
-        .map((l) => {
-        const [mode, ...rest] = l.split(" ");
-        return { mode, path: rest.join(" ") };
-    });
-}
-export function readBlob(tenant, scope, ref, p) {
-    if (!repoExists(tenant, scope))
-        return null;
-    return blob(repoDir(tenant, scope), ref, p);
-}
-/** The whole tree at a ref as deploy files — what a push turns into a workspace. */
-export function filesAt(tenant, scope, ref) {
-    const dir = repoDir(tenant, scope);
-    return listTree(tenant, scope, ref).flatMap((t) => {
-        const content = blob(dir, ref, t.path);
-        return content === null ? [] : [{ path: t.path, content }];
-    });
-}
-/**
- * What a ref would change on main: every file that differs, with both sides.
- * The branch's own commits are `listCommits({ ref })`; this is the net
- * effect, which is what a reviewer reads.
- */
-export function diffRefs(tenant, scope, base, head) {
-    if (!headSha(tenant, scope, base) || !headSha(tenant, scope, head))
-        return [];
-    const dir = repoDir(tenant, scope);
-    const out = git(dir, ["diff", "--name-status", `${base}...${head}`]);
-    return out.split("\n").filter(Boolean).map((line) => {
-        const [status, p] = line.split("\t");
-        return {
-            path: p,
-            before: status === "A" ? null : blob(dir, base, p),
-            after: status === "D" ? null : blob(dir, head, p),
-        };
-    });
-}
-/**
- * Merge a branch into main and return the new main. A fast-forward when it
- * is one; otherwise a merge commit whose tree is the BRANCH's — the branch
- * is what the person reviewed and chose, and a three-way textual merge of
- * markdown with no one to resolve conflicts would deploy text nobody wrote.
- * Both parents are recorded, so history shows the merge for what it was.
- */
-export function mergeBranch(tenant, scope, branch, meta = {}) {
-    const dir = repoDir(tenant, scope);
-    const main = headSha(tenant, scope);
-    const head = headSha(tenant, scope, `refs/heads/${safe(branch, "branch")}`);
-    if (!head)
-        throw new Error(`no branch "${branch}"`);
-    if (!main) {
-        git(dir, ["update-ref", "refs/heads/main", head]);
-        return { sha: head, fastForward: true };
-    }
-    const isAncestor = spawnSync("git", ["--git-dir", dir, "merge-base", "--is-ancestor", main, head]).status === 0;
-    if (isAncestor) {
-        git(dir, ["update-ref", "refs/heads/main", head, main]);
-        return { sha: head, fastForward: true };
-    }
-    const tree = git(dir, ["rev-parse", `${head}^{tree}`]).trim();
-    const who = meta.by ?? "foldrun";
-    const email = who.includes("@") ? who : `${who}@foldrun`;
-    const name = who.includes("@") ? who.split("@")[0] : who;
-    const date = new Date().toISOString();
-    const sha = git(dir, ["commit-tree", tree, "-p", main, "-p", head, "-m", `merge ${branch} into main`], {
-        env: {
-            GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-            GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-        },
-    }).trim();
-    git(dir, ["update-ref", "refs/heads/main", sha, main]);
-    return { sha, fastForward: false };
-}
-export function deleteBranch(tenant, scope, branch) {
-    if (branch === "main")
-        throw new Error("main is the default branch");
-    git(repoDir(tenant, scope), ["update-ref", "-d", `refs/heads/${safe(branch, "branch")}`]);
-}
-/** Push main to another remote — a GitHub or GitLab mirror. Blocking; callers
- *  run it off the request path. The token never touches disk: it is in the
- *  URL for this one process and nowhere else. */
-export function pushMirror(tenant, scope, url) {
-    if (!headSha(tenant, scope))
-        return { ok: false, detail: "nothing to push yet" };
-    const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "push", "--quiet", url, "+refs/heads/main:refs/heads/main"], {
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
-        timeout: 60_000,
-    });
-    const detail = (r.stderr?.toString() ?? "").trim()
-        // Never echo the URL back: it carries the token.
-        .replaceAll(url, "<mirror>")
-        .slice(0, 500);
-    return { ok: r.status === 0, detail: r.status === 0 ? "pushed" : detail || "push failed" };
-}
-/**
- * Where the compiled pre-receive check is, found on disk rather than through
- * require.resolve — a bundler rewrites require.resolve("pkg") into a module
- * id, and the hook was once told to run a script called "51113". Searched
- * from the working directory upward: the monorepo layout, then an installed
- * package. Empty when there is no compiled check (a dev server on the source
- * tree), in which case a push is checked at deploy instead of refused — the
- * same rules, one step later.
- */
-export function hookScriptPath() {
-    let dir = process.cwd();
-    for (let i = 0; i < 6; i++) {
-        for (const rel of ["packages/core/dist/src/git-hook.js", "node_modules/@foldrun/core/dist/src/git-hook.js"]) {
-            const candidate = path.join(dir, rel);
-            if (fs.existsSync(candidate))
-                return candidate;
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return "";
-}
-/**
- * The pre-receive hook: a push that fails the deploy checks is refused with
- * the errors in the pusher's terminal, instead of accepted and then not
- * deployed. The hook shells out to node with the compiled check, so it runs
- * the same rules as a dashboard deploy; which node and which script are
- * passed in the environment by the HTTP route, because a hook inherits git's
- * environment and nothing else.
- */
-export function installHooks(dir) {
-    const hooks = path.join(dir, "hooks");
-    fs.mkdirSync(hooks, { recursive: true });
-    const hook = path.join(hooks, "pre-receive");
-    const script = `#!/bin/sh
-# Installed by foldrun. Refuses a push to main whose tree fails the checks.
-[ -n "$FOLDRUN_HOOK_NODE" ] && [ -n "$FOLDRUN_HOOK_SCRIPT" ] || exit 0
-exec "$FOLDRUN_HOOK_NODE" "$FOLDRUN_HOOK_SCRIPT"
-`;
-    if (!fs.existsSync(hook) || fs.readFileSync(hook, "utf8") !== script) {
-        fs.writeFileSync(hook, script, { mode: 0o755 });
-    }
-}

package/dist/src/tar.d.ts

@@ -1,30 +0,0 @@
-export interface TarEntry {
-    path: string;
-    content: Buffer;
-}
-/**
- * Every regular file in a gzipped tarball.
- *
- * Directories, symlinks, and pax/global headers are skipped: a workspace is
- * files, and following a link out of the archive is exactly the thing a deploy
- * from an untrusted repository must not do.
- */
-export declare function readTarGz(gz: Buffer): TarEntry[];
-/**
- * Drop the single wrapper directory an archive is rooted at.
- *
- * GitHub tarballs are rooted at `owner-repo-<sha>/`, which is not part of
- * anyone's workspace. Stripped only when *every* entry shares one first
- * segment, so an archive that is already flat is left alone.
- */
-export declare function stripRoot(entries: TarEntry[]): TarEntry[];
-/**
- * Read a tarball as the file list a deploy ships.
- *
- * `subdir` picks a workspace living inside a larger repository — the common
- * case, since a repo usually holds more than one thing.
- */
-export declare function filesFromTarball(gz: Buffer, subdir?: string): {
-    path: string;
-    content: string;
-}[];

package/dist/src/tar.js

@@ -1,112 +0,0 @@
-// Reading a .tar.gz, so a deploy can come from a GitHub tarball.
-//
-// `GET /repos/{owner}/{repo}/tarball/{sha}` is one HTTP call and needs no git
-// binary, no clone, and no working copy on the server — which is the whole
-// reason a markdown workspace can deploy from a webhook in a few hundred
-// milliseconds. What it returns is a tar.gz, and Node has gzip but not tar.
-//
-// Deliberately dependency-free, for the same reason the cron parser is: tar is
-// 512-byte blocks with an octal size field, and a reader is shorter than the
-// argument about which library to add.
-import zlib from "node:zlib";
-import { trimSlashes } from "./paths.js";
-const BLOCK = 512;
-const str = (b, off, len) => {
-    const raw = b.subarray(off, off + len);
-    const end = raw.indexOf(0);
-    return raw.subarray(0, end === -1 ? raw.length : end).toString("utf8");
-};
-// Sizes are octal, space- or NUL-padded. GNU also writes base-256 for large
-// files, flagged by the high bit — irrelevant for markdown, but a silent
-// misparse would be worse than a clear refusal.
-function size(b, off) {
-    if (b[off] & 0x80)
-        throw new Error("tar: base-256 size field is not supported");
-    const raw = str(b, off, 12).trim();
-    return raw ? parseInt(raw, 8) : 0;
-}
-/**
- * Every regular file in a gzipped tarball.
- *
- * Directories, symlinks, and pax/global headers are skipped: a workspace is
- * files, and following a link out of the archive is exactly the thing a deploy
- * from an untrusted repository must not do.
- */
-export function readTarGz(gz) {
-    const buf = zlib.gunzipSync(gz);
-    const out = [];
-    let longName = null;
-    for (let off = 0; off + BLOCK <= buf.length;) {
-        const header = buf.subarray(off, off + BLOCK);
-        // Two consecutive zero blocks end the archive; one is enough to stop.
-        if (header.every((b) => b === 0))
-            break;
-        const name = str(header, 0, 100);
-        const bytes = size(header, 124);
-        const type = String.fromCharCode(header[156]) || "0";
-        const prefix = str(header, 345, 155);
-        off += BLOCK;
-        const body = buf.subarray(off, off + bytes);
-        off += Math.ceil(bytes / BLOCK) * BLOCK;
-        // GNU long name: the next header's name lives in this entry's body.
-        if (type === "L") {
-            longName = body.toString("utf8").replace(/\0+$/, "");
-            continue;
-        }
-        if (type !== "0" && type !== "\0") {
-            longName = null;
-            continue;
-        }
-        const full = longName ?? (prefix ? `${prefix}/${name}` : name);
-        longName = null;
-        if (full)
-            out.push({ path: full, content: Buffer.from(body) });
-    }
-    return out;
-}
-/**
- * Drop the single wrapper directory an archive is rooted at.
- *
- * GitHub tarballs are rooted at `owner-repo-<sha>/`, which is not part of
- * anyone's workspace. Stripped only when *every* entry shares one first
- * segment, so an archive that is already flat is left alone.
- */
-export function stripRoot(entries) {
-    if (entries.length === 0)
-        return entries;
-    const first = entries[0].path.split("/")[0];
-    if (!entries.every((e) => e.path.split("/")[0] === first && e.path.includes("/"))) {
-        return entries;
-    }
-    return entries.map((e) => ({ ...e, path: e.path.slice(first.length + 1) }));
-}
-/**
- * Read a tarball as the file list a deploy ships.
- *
- * `subdir` picks a workspace living inside a larger repository — the common
- * case, since a repo usually holds more than one thing.
- */
-export function filesFromTarball(gz, subdir = "") {
-    const prefix = trimSlashes(subdir, "both");
-    const out = [];
-    for (const entry of stripRoot(readTarGz(gz))) {
-        let rel = entry.path;
-        if (prefix) {
-            if (!rel.startsWith(`${prefix}/`))
-                continue;
-            rel = rel.slice(prefix.length + 1);
-        }
-        // A tarball is untrusted input: an entry can name anything at all, and
-        // `../` in an archive is the oldest way to write outside the destination.
-        if (rel.split("/").includes("..") || rel.startsWith("/"))
-            continue;
-        // AppleDouble sidecars. macOS `tar` writes a `._name` beside every file to
-        // carry metadata no other system wants; they are not part of anyone's
-        // workspace, and letting one through means a deploy rejected for shipping
-        // a file the author never wrote.
-        if ((rel.split("/").pop() ?? "").startsWith("._"))
-            continue;
-        out.push({ path: rel, content: entry.content.toString("utf8") });
-    }
-    return out;
-}