@foldrun/core 2.11.0 → 2.12.0

package/LICENSE

@@ -1,39 +1,105 @@
-foldrun proprietary licence
+# Functional Source License, Version 1.1, ALv2 Future License
 
-Copyright (c) 2026 foldrun. All rights reserved.
+## Abbreviation
 
-This software, its source code and its documentation are the property of
-foldrun. They are licensed, not sold.
+FSL-1.1-ALv2
 
-You may install and run the foldrun packages published to npm (`foldrun`
-and `@foldrun/core`) to write, check, run and deploy your own agents,
-flows and workspaces, on your own machines and with the foldrun platform.
-That includes the copies installing and running need, for your own use:
-package caches and mirrors, CI and build machines, container images and
-backups.
+## Notice
 
-You may not, except where the law allows it despite this restriction:
-copy, modify, merge, publish, distribute, sublicense, rent or sell the
-software or any part of it; reverse engineer, decompile or disassemble it;
-or use it to build a product or service that competes with foldrun.
+Copyright 2026 foldrun
 
-What you write with the software (your agents, flows, knowledge and other
-files) is yours.
+## Terms and Conditions
 
-Third-party components the software includes or installs (its npm
-dependencies) remain under their own licences.
+### Licensor ("We")
 
-This licence ends automatically if you break its terms, and you must then
-stop using the software.
+The party offering the Software under these Terms and Conditions.
 
-Versions published before 17 October 2026 under the Apache License 2.0
-remain available under that licence for those versions only.
+### The Software
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. TO THE EXTENT THE
-LAW ALLOWS, IN NO EVENT SHALL FOLDRUN BE LIABLE FOR ANY CLAIM, DAMAGES OR
-OTHER LIABILITY ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
-ITS USE.
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
 
-Questions: hello@foldrun.io
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/LICENSING.md

@@ -0,0 +1,101 @@
+# Licensing
+
+foldrun is **source-available** under the **Functional Source License,
+Version 1.1, with an Apache 2.0 future licence** (`FSL-1.1-ALv2`). The full
+terms are in [LICENSE](LICENSE); they are the standard FSL text, unchanged,
+and they are what binds. This page explains them in plain English. If the
+two ever disagree, LICENSE wins.
+
+## In one paragraph
+
+Use foldrun for anything except selling it, or offering it to others as a
+product or service that competes with foldrun. Personal use and use inside
+your own company are free, at any size. Every version becomes Apache 2.0,
+with no restrictions, two years after it is released.
+
+## What you may do, free
+
+- **Use it yourself**: on your laptop, on your own server, for your own
+  agents and flows.
+- **Use it inside your company or organisation**, of any size, for your own
+  work: your team's agents, your internal automations, your CI.
+- **Read, change and fork the code**, and keep your changes private or
+  share them, as long as the result is used for one of the purposes on
+  this list.
+- **Teach and research with it** (non-commercial education and research).
+- **Set it up for a client as a consultant or agency**, as long as the
+  client is the one using it, for their own purposes, under these same
+  terms.
+
+## What needs a commercial licence
+
+The licence calls these a *Competing Use*: making foldrun available **to
+others** in a **commercial** product or service that substitutes for
+foldrun, substitutes for a foldrun product or service that existed when that
+version was released, or offers the same or substantially similar
+functionality. For example:
+
+- running foldrun, or a modified copy, as a hosted agent platform that other
+  people or companies sign up to or pay for;
+- reselling it, white-labelling it, or bundling it into a product you sell
+  whose value is what foldrun does;
+- selling access to a managed foldrun instance.
+
+If you want to do any of these, or are not sure whether your use counts,
+write to **hello@foldrun.io**. Commercial licences are available.
+
+## The two-year rule
+
+Each version is offered under FSL from the day it is released. On the
+second anniversary of that release, that version is **also** available under
+the Apache License 2.0 — irrevocably, for everyone, for any purpose. Newer
+versions are not affected until they reach their own second anniversary.
+
+## Versions released under other terms
+
+| Versions | Licence |
+|---|---|
+| released before 17 October 2026 | Apache License 2.0 |
+| released 17 October 2026 up to the first FSL release | the foldrun proprietary licence that shipped in each package |
+| the first FSL release and later | FSL-1.1-ALv2 (this page) |
+
+A version keeps the licence it was released under.
+
+## What stays yours
+
+What you write with foldrun — your agents, flows, knowledge, skills, tools,
+evals and the outputs of your runs — is yours. This licence covers foldrun's
+code, not your work.
+
+## Name and logo
+
+The licence does not give you the foldrun name, logo or other trademarks,
+except to say truthfully where the code came from. A fork you distribute
+needs its own name.
+
+## Third-party code
+
+foldrun's dependencies, and anything it installs, stay under their own
+licences.
+
+## Patents
+
+Using foldrun for a permitted purpose includes a licence to any foldrun
+patents that use needs. That patent licence ends for anyone who sues claiming
+the software infringes a patent.
+
+## No warranty
+
+foldrun is provided as is, with no warranty, and with no liability for
+damages, as LICENSE sets out in full.
+
+## Contributing
+
+Contributions are welcome. Before we merge one, we ask you to agree that we
+may release it under these terms and under commercial licences, so the
+project can keep both. We will send the agreement with your first pull
+request.
+
+## Questions
+
+hello@foldrun.io. This page is a summary to help you, not legal advice.

package/README.md

@@ -151,8 +151,8 @@ Most people want the CLI, not this package — `npm install -g foldrun`.
 The command-line tool is its own package,
 [`foldrun`](https://www.npmjs.com/package/foldrun), and depends on
 this package. The reference documentation is at
-[docs.foldrun.io](https://docs.foldrun.io). Every foldrun repository is
-private; see "Hosting it" below.
+[docs.foldrun.io](https://docs.foldrun.io). foldrun is source-available
+under the Functional Source License (see "Licence" below).
 
 ### Templates and workspaces
 
@@ -189,8 +189,11 @@ This package is the framework: everything needed to read a workspace and
 run it on the machine you are on. The platform — the dashboard, a queue and
 its worker, one sandbox per step, a vault, metering, a team — is built on
 it, in a separate package that plugs in through `src/platform.ts`. Nothing
-in this repository imports it. The platform is hosted by foldrun and is not
-distributed; `foldrun deploy` moves a workspace from your machine to it
+in this repository imports it. The platform is
+[foldrun-platform](https://github.com/foldrun-io/foldrun-platform) and
+[foldrun-web](https://github.com/foldrun-io/foldrun-web): run it on your own
+server with Docker Compose (`foldrun-web/self-hosting`), or use foldrun's
+hosted one; `foldrun deploy` moves a workspace from your machine to either
 unchanged.
 
 ## Requirements
@@ -269,5 +272,10 @@ per request (fine to thousands of runs).
 
 ## Licence
 
-Proprietary; see [LICENSE](LICENSE). Versions published before 17 October
-2026 were Apache-2.0 and stay so.
+Source-available under the [Functional Source License 1.1, Apache 2.0 future
+licence](LICENSE) (`FSL-1.1-ALv2`). Use it for anything except offering it to
+others as a competing commercial product or service: personal use and use
+inside your own company are free, at any size. Each version becomes Apache 2.0
+two years after its release. [LICENSING.md](LICENSING.md) explains what is
+allowed and what needs a commercial licence (hello@foldrun.io), and which
+licence earlier versions shipped under.

package/dist/src/runner.js

@@ -1016,7 +1016,7 @@ grantsOnly = false) {
     // EMAIL_FROM]`): granting the tool grants them, the way an API tool's
     // referenced credentials always travelled with it. Before, only the
     // agent's own `secrets:` counted, so an agent that granted desk_email and
-    // declared nothing failed with "RESEND_API_KEY is not set" (strata-desk,
+    // declared nothing failed with "RESEND_API_KEY is not set" (a customer desk,
     // 1 Oct). `proxied` / `materialised` say how, not what, and add nothing.
     const toolSecrets = [];
     // Does any granted tool act outside the workspace (`outward: true`)? The

package/dist/src/scan.js

@@ -811,7 +811,7 @@ export function scanFiles(files, options = {}) {
         // Frontmatter YAML cannot read. Until 2026-10-21 nothing reported it for
         // a skill or a library file: frontOf below reads it as "no frontmatter"
         // and moves on, and the deploy's own refusal covers only the workspace's
-        // definition files. A vaza.ai skill with `description: … (Markdown,
+        // definition files. A customer's skill with `description: … (Markdown,
         // frontmatter, ::: directives) …` deployed clean, ran (the runtime quotes
         // the value and retries), and was refused by the source API on its next
         // save.

package/dist/src/test-mode.d.ts

@@ -113,7 +113,7 @@ export declare function restoreDivertedDirs(wsRoot: string, before: Map<string,
  * are kept under runs/<id>/test-writes/, never on the workspace, so each
  * step's copy of the workspace gets them laid over it — otherwise a step
  * reads the real files, and a flow that hands work on through storage/
- * tests something no live run does: on 2026-10-03 a strata-desk test run's
+ * tests something no live run does: on 2026-10-03 a customer desk's test run's
  * compiler wrote today's PASS report, and the mailer was handed the
  * morning's FAIL one and refused. Times are kept, so a verify that asks
  * whether a file is fresh answers for the step that wrote it. Returns the

package/dist/src/test-mode.js

@@ -288,7 +288,7 @@ export function restoreDivertedDirs(wsRoot, before, to, note, handed = before) {
  * are kept under runs/<id>/test-writes/, never on the workspace, so each
  * step's copy of the workspace gets them laid over it — otherwise a step
  * reads the real files, and a flow that hands work on through storage/
- * tests something no live run does: on 2026-10-03 a strata-desk test run's
+ * tests something no live run does: on 2026-10-03 a customer desk's test run's
  * compiler wrote today's PASS report, and the mailer was handed the
  * morning's FAIL one and refused. Times are kept, so a verify that asks
  * whether a file is fresh answers for the step that wrote it. Returns the

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@foldrun/core",
-  "version": "2.11.0",
+  "version": "2.12.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
-  "license": "SEE LICENSE IN LICENSE",
+  "license": "FSL-1.1-ALv2",
   "type": "module",
   "exports": {
     ".": {
@@ -39,10 +39,11 @@
     "src",
     "index.ts",
     "templates",
-    "README.md"
+    "README.md",
+    "LICENSING.md"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
     "prepare": "npm run build && (test ! -f .githooks/install.sh || sh .githooks/install.sh)",
     "prepublishOnly": "npm run build",
     "test": "FOLDRUN_DATA=$(mktemp -d /tmp/foldrun-test-XXXXXX) node --test *.test.ts $(ls tests/*.test.ts | grep -v e2e)",

package/src/runner.ts

@@ -1157,7 +1157,7 @@ export function agentContext(
   // EMAIL_FROM]`): granting the tool grants them, the way an API tool's
   // referenced credentials always travelled with it. Before, only the
   // agent's own `secrets:` counted, so an agent that granted desk_email and
-  // declared nothing failed with "RESEND_API_KEY is not set" (strata-desk,
+  // declared nothing failed with "RESEND_API_KEY is not set" (a customer desk,
   // 1 Oct). `proxied` / `materialised` say how, not what, and add nothing.
   const toolSecrets: string[] = [];
   // Does any granted tool act outside the workspace (`outward: true`)? The

package/src/scan.ts

@@ -907,7 +907,7 @@ export function scanFiles(files: ScanFile[], options: ScanOptions = {}): ScanFin
     // Frontmatter YAML cannot read. Until 2026-10-21 nothing reported it for
     // a skill or a library file: frontOf below reads it as "no frontmatter"
     // and moves on, and the deploy's own refusal covers only the workspace's
-    // definition files. A vaza.ai skill with `description: … (Markdown,
+    // definition files. A customer's skill with `description: … (Markdown,
     // frontmatter, ::: directives) …` deployed clean, ran (the runtime quotes
     // the value and retries), and was refused by the source API on its next
     // save.

package/src/test-mode.ts

@@ -314,7 +314,7 @@ export function restoreDivertedDirs(
  * are kept under runs/<id>/test-writes/, never on the workspace, so each
  * step's copy of the workspace gets them laid over it — otherwise a step
  * reads the real files, and a flow that hands work on through storage/
- * tests something no live run does: on 2026-10-03 a strata-desk test run's
+ * tests something no live run does: on 2026-10-03 a customer desk's test run's
  * compiler wrote today's PASS report, and the mailer was handed the
  * morning's FAIL one and refused. Times are kept, so a verify that asks
  * whether a file is fresh answers for the step that wrote it. Returns the

package/dist/src/git-hook.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/src/git-hook.js

@@ -1,70 +0,0 @@
-// The pre-receive check, run by git inside a push.
-//
-// git feeds "<old> <new> <ref>" lines on stdin. For a push to main, read the
-// tree at the new commit straight from the object store and run the deploy
-// checks on it. Any issue: print them and exit non-zero — the push is refused
-// and the person sees exactly what a dashboard deploy would have told them,
-// in their terminal, before anything changed.
-//
-// Runs as its own process under git's environment. GIT_DIR is set by git.
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { deployIssues, runsInFlight } from "./deploy.js";
-const dir = process.env.GIT_DIR;
-if (!dir)
-    process.exit(0);
-// `_library.git` is the account shelf, not a workspace: it holds tools,
-// skills and knowledge and has no agents by definition. The workspace rules
-// refused every push to it with "no agents". Its sync (syncLibraryFromTree)
-// validates what it accepts on receive; nothing here to add yet.
-// Inside a hook git sets GIT_DIR relative to the repo ("."), so resolve it
-// against the cwd before asking for its name.
-if (path.basename(path.resolve(process.cwd(), dir)) === "_library.git")
-    process.exit(0);
-const input = fs.readFileSync(0, "utf8");
-const git = (args) => {
-    const r = spawnSync("git", ["--git-dir", dir, ...args], { maxBuffer: 64 * 1024 * 1024 });
-    return r.status === 0 ? r.stdout.toString() : null;
-};
-// The client is gone by the time the deploy runs, so this is the only moment
-// a person can be told their push will not take effect yet. A warning, not a
-// refusal: the commit is fine and the scheduler applies it when the runs end.
-const here = path.basename(path.resolve(process.cwd(), dir));
-if (here.endsWith(".git")) {
-    const workspace = here.slice(0, -4);
-    const tenant = path.basename(path.resolve(process.cwd(), dir, "..", ".."));
-    try {
-        const live = runsInFlight(tenant, workspace);
-        if (live.length) {
-            process.stderr.write(`\nfoldrun: ${live.length} run${live.length === 1 ? " is" : "s are"} in flight, so this push is not live yet.\n` +
-                `  It is on main and will be applied automatically when they finish.\n\n`);
-        }
-    }
-    catch {
-        // A warning that cannot be computed must never fail a push.
-    }
-}
-let refused = false;
-for (const line of input.split("\n").filter(Boolean)) {
-    const [, newSha, ref] = line.split(" ");
-    if (ref !== "refs/heads/main" || /^0+$/.test(newSha))
-        continue;
-    const tree = git(["ls-tree", "-r", "--name-only", newSha]) ?? "";
-    const files = tree
-        .split("\n")
-        .filter(Boolean)
-        .flatMap((p) => {
-        const content = git(["show", `${newSha}:${p}`]);
-        return content === null ? [] : [{ path: p, content }];
-    });
-    const issues = deployIssues(files);
-    if (issues.length) {
-        refused = true;
-        process.stderr.write(`\nfoldrun: refusing this push — ${issues.length} problem${issues.length === 1 ? "" : "s"} the checks would have stopped at deploy:\n`);
-        for (const i of issues)
-            process.stderr.write(`  ${i.where}: ${i.message}\n`);
-        process.stderr.write(`\nFix and push again. (foldrun check runs the same rules locally.)\n\n`);
-    }
-}
-process.exit(refused ? 1 : 0);

package/dist/src/git.d.ts

@@ -1,37 +0,0 @@
-/**
- * The secret a repository signs its pushes with.
- *
- * Derived rather than stored, exactly like a flow's webhook token: HMAC of the
- * workspace's identity under the install key. Nothing new to persist, unique
- * per workspace, and rotating FOLDRUN_SECRET_KEY invalidates every connection
- * at once.
- */
-export declare function gitSecret(tenant: string, workspace: string): string;
-export declare function gitHookPath(tenant: string, workspace: string): string;
-/**
- * Whether a request really came from the repository it claims to.
- *
- * Compared in constant time: a byte-by-byte early return leaks the expected
- * signature to anyone willing to time enough requests. The raw body is
- * required — re-serializing parsed JSON changes bytes GitHub signed.
- */
-export declare function verifySignature(secret: string, rawBody: string, header: string | null): boolean;
-export interface PushEvent {
-    repo: string;
-    /** Full ref, e.g. refs/heads/main. */
-    ref: string;
-    branch: string;
-    commit: string;
-    message: string | null;
-    pusher: string | null;
-}
-/** What we need out of a GitHub push payload, or null if it isn't one. */
-export declare function parsePush(payload: unknown): PushEvent | null;
-/**
- * The repository at one commit, as a gzipped tarball.
- *
- * A token is only needed for a private repository. It is read from the
- * environment rather than taken as an argument so a caller cannot be tricked
- * into forwarding one somewhere else.
- */
-export declare function fetchTarball(repo: string, commit: string): Promise<Buffer>;

package/dist/src/git.js

@@ -1,101 +0,0 @@
-// git push → deployed.
-//
-// A workspace is markdown, so there is no build to run: a push is a fetch of
-// the tree at that commit, a check, and a swap. This module is the GitHub half
-// — the secret a repository signs with, the payload shape, and pulling the
-// tarball. `deploy.ts` decides whether the result is allowed to go live.
-//
-// The tarball, not a clone: one HTTP call, no git binary, no working copy kept
-// on the server. A markdown workspace is a few hundred kilobytes.
-import crypto from "node:crypto";
-import { installKey } from "./webhook.js";
-/** GitHub refuses to fetch anything larger, and neither should we. */
-const MAX_TARBALL = 25 * 1024 * 1024;
-/**
- * The secret a repository signs its pushes with.
- *
- * Derived rather than stored, exactly like a flow's webhook token: HMAC of the
- * workspace's identity under the install key. Nothing new to persist, unique
- * per workspace, and rotating FOLDRUN_SECRET_KEY invalidates every connection
- * at once.
- */
-export function gitSecret(tenant, workspace) {
-    return crypto
-        .createHmac("sha256", installKey())
-        .update(`git/${tenant}/${workspace}`)
-        .digest("hex");
-}
-export function gitHookPath(tenant, workspace) {
-    return `/api/git/${tenant}/${workspace}`;
-}
-/**
- * Whether a request really came from the repository it claims to.
- *
- * Compared in constant time: a byte-by-byte early return leaks the expected
- * signature to anyone willing to time enough requests. The raw body is
- * required — re-serializing parsed JSON changes bytes GitHub signed.
- */
-export function verifySignature(secret, rawBody, header) {
-    if (!header)
-        return false;
-    const expected = `sha256=${crypto.createHmac("sha256", secret).update(rawBody).digest("hex")}`;
-    const a = Buffer.from(expected);
-    const b = Buffer.from(header);
-    return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
-/** What we need out of a GitHub push payload, or null if it isn't one. */
-export function parsePush(payload) {
-    if (!payload || typeof payload !== "object")
-        return null;
-    const p = payload;
-    const repo = p.repository?.full_name;
-    const ref = p.ref;
-    const commit = p.after;
-    if (typeof repo !== "string" || typeof ref !== "string" || typeof commit !== "string") {
-        return null;
-    }
-    // A deleted branch reports all zeros and ships no tree.
-    if (/^0+$/.test(commit))
-        return null;
-    return {
-        repo,
-        ref,
-        branch: ref.replace(/^refs\/heads\//, ""),
-        commit,
-        message: typeof p.head_commit?.message === "string" ? p.head_commit.message : null,
-        pusher: typeof p.pusher?.name === "string" ? p.pusher.name : null,
-    };
-}
-/**
- * The repository at one commit, as a gzipped tarball.
- *
- * A token is only needed for a private repository. It is read from the
- * environment rather than taken as an argument so a caller cannot be tricked
- * into forwarding one somewhere else.
- */
-export async function fetchTarball(repo, commit) {
-    if (!/^[\w.-]+\/[\w.-]+$/.test(repo))
-        throw new Error(`refusing to fetch "${repo}"`);
-    if (!/^[0-9a-f]{7,40}$/i.test(commit))
-        throw new Error(`refusing to fetch commit "${commit}"`);
-    const headers = {
-        accept: "application/vnd.github+json",
-        "user-agent": "foldrun",
-        "x-github-api-version": "2022-11-28",
-    };
-    const token = process.env.GITHUB_TOKEN;
-    if (token)
-        headers.authorization = `Bearer ${token}`;
-    const res = await fetch(`https://api.github.com/repos/${repo}/tarball/${commit}`, { headers });
-    if (!res.ok) {
-        throw new Error(`GitHub returned ${res.status} for ${repo}@${commit.slice(0, 8)}` +
-            (res.status === 404 && !token
-                ? " — a private repository needs GITHUB_TOKEN set on the server"
-                : ""));
-    }
-    const buf = Buffer.from(await res.arrayBuffer());
-    if (buf.length > MAX_TARBALL) {
-        throw new Error(`${repo} is ${Math.round(buf.length / 1e6)}MB — too large to deploy`);
-    }
-    return buf;
-}

package/dist/src/gitrepo.d.ts

@@ -1,113 +0,0 @@
-import type { DiffOp, Revision, RevisionFile, RevisionSummary } from "./history.ts";
-/** Where a workspace's bare repository lives. `@library` is the account shelf. */
-export declare function repoDir(tenant: string, scope: string): string;
-/** Is there a git binary? Checked once; an install without one keeps the journal. */
-export declare function gitAvailable(): boolean;
-export declare function repoExists(tenant: string, scope: string): boolean;
-/** Create the repository if it is not there. Idempotent. */
-export declare function ensureRepo(tenant: string, scope: string): string;
-export declare function headSha(tenant: string, scope: string, ref?: string): string | null;
-/**
- * Apply a change set as one commit on main, using plumbing against a scratch
- * index seeded from HEAD. No working copy, no checkout: each changed path is
- * hashed straight from its content into the object store.
- *
- * Returns the new commit, or null when the tree did not change.
- */
-export declare function commitChanges(tenant: string, scope: string, files: RevisionFile[], meta?: {
-    by?: string;
-    message?: string;
-    at?: string;
-}): string | null;
-/** Commits on main, newest first, as the same summary the journal gave. */
-export declare function listCommits(tenant: string, scope: string, opts?: {
-    forPath?: string;
-    limit?: number;
-    ref?: string;
-}): RevisionSummary[];
-/** One commit in full: every changed file with its before and after. */
-export declare function readCommit(tenant: string, scope: string, sha: string, forPath?: string): Revision | null;
-export interface RefInfo {
-    name: string;
-    sha: string;
-    /** Commit subject and time, for a branch list that says what each is. */
-    subject: string;
-    at: string;
-}
-export declare function listRefs(tenant: string, scope: string, kind: "heads" | "tags"): RefInfo[];
-/**
- * The commit a restore means by `to`, on main's history:
- *
- *   a sha or a prefix of one      that commit
- *   a branch or tag name          where it points
- *   an ISO date or time           the last commit on main at or before it
- *   "3d", "12h", "90m", "2w"      the same, that long ago
- *
- * Null when nothing matches — before the first commit, or a name that is
- * not there. Throws on a `to` that cannot be any of these, so a typo is a
- * 400 rather than a silent "nothing found".
- */
-export declare function resolveRestorePoint(tenant: string, scope: string, to: string, now?: number): {
-    sha: string;
-    at: string;
-    by: string;
-    message: string;
-} | null;
-/** The files at a commit, for a browser or a deploy. */
-export declare function listTree(tenant: string, scope: string, ref?: string): {
-    path: string;
-    mode: string;
-}[];
-export declare function readBlob(tenant: string, scope: string, ref: string, p: string): string | null;
-/** The whole tree at a ref as deploy files — what a push turns into a workspace. */
-export declare function filesAt(tenant: string, scope: string, ref: string): {
-    path: string;
-    content: string;
-}[];
-/**
- * What a ref would change on main: every file that differs, with both sides.
- * The branch's own commits are `listCommits({ ref })`; this is the net
- * effect, which is what a reviewer reads.
- */
-export declare function diffRefs(tenant: string, scope: string, base: string, head: string): RevisionFile[];
-/**
- * Merge a branch into main and return the new main. A fast-forward when it
- * is one; otherwise a merge commit whose tree is the BRANCH's — the branch
- * is what the person reviewed and chose, and a three-way textual merge of
- * markdown with no one to resolve conflicts would deploy text nobody wrote.
- * Both parents are recorded, so history shows the merge for what it was.
- */
-export declare function mergeBranch(tenant: string, scope: string, branch: string, meta?: {
-    by?: string;
-}): {
-    sha: string;
-    fastForward: boolean;
-};
-export declare function deleteBranch(tenant: string, scope: string, branch: string): void;
-/** Push main to another remote — a GitHub or GitLab mirror. Blocking; callers
- *  run it off the request path. The token never touches disk: it is in the
- *  URL for this one process and nowhere else. */
-export declare function pushMirror(tenant: string, scope: string, url: string): {
-    ok: boolean;
-    detail: string;
-};
-/**
- * Where the compiled pre-receive check is, found on disk rather than through
- * require.resolve — a bundler rewrites require.resolve("pkg") into a module
- * id, and the hook was once told to run a script called "51113". Searched
- * from the working directory upward: the monorepo layout, then an installed
- * package. Empty when there is no compiled check (a dev server on the source
- * tree), in which case a push is checked at deploy instead of refused — the
- * same rules, one step later.
- */
-export declare function hookScriptPath(): string;
-/**
- * The pre-receive hook: a push that fails the deploy checks is refused with
- * the errors in the pusher's terminal, instead of accepted and then not
- * deployed. The hook shells out to node with the compiled check, so it runs
- * the same rules as a dashboard deploy; which node and which script are
- * passed in the environment by the HTTP route, because a hook inherits git's
- * environment and nothing else.
- */
-export declare function installHooks(dir: string): void;
-export { type DiffOp };

package/dist/src/gitrepo.js

@@ -1,404 +0,0 @@
-// A git repository per workspace — the platform as the remote.
-//
-//   git remote add foldrun https://app.foldrun.io/git/<tenant>/<workspace>.git
-//   git push foldrun main          → deploys, commit on record
-//   git clone …/<workspace>.git    → the workspace, with its whole history
-//
-// One bare repository per workspace on the data volume. Every change the
-// platform makes — a dashboard save, a deploy, a deletion — is a commit into
-// it, made with git's own plumbing against a scratch index so no working copy
-// is ever kept. Every change a person makes is a push into it. So there is
-// one history, it is real git, and anyone can take it away with `git clone`.
-//
-// This deliberately stops at being a remote. Pull requests, reviews and
-// issues are a forge, which is a product; GitHub and GitLab remain a fine
-// mirror for anyone who wants that on top.
-//
-// history.ts delegates here when a repository exists, so the History page,
-// the per-file panel and Observe's eval attribution all read git without
-// knowing it. The journal it kept before stays as the fallback for an install
-// without a git binary.
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { dataRoot } from "./paths.js";
-const SAFE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/;
-const safe = (v, what) => {
-    if (!SAFE.test(v))
-        throw new Error(`illegal ${what}: ${v}`);
-    return v;
-};
-/** Where a workspace's bare repository lives. `@library` is the account shelf. */
-export function repoDir(tenant, scope) {
-    safe(tenant, "tenant");
-    const name = scope === "@library" ? "_library" : safe(scope, "workspace");
-    return path.join(dataRoot(), tenant, ".git", `${name}.git`);
-}
-let gitChecked = null;
-/** Is there a git binary? Checked once; an install without one keeps the journal. */
-export function gitAvailable() {
-    if (gitChecked === null) {
-        gitChecked = spawnSync("git", ["--version"], { stdio: "ignore" }).status === 0;
-    }
-    return gitChecked;
-}
-function git(dir, args, opts = {}) {
-    const r = spawnSync("git", ["--git-dir", dir, ...args], {
-        input: opts.input,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0", ...opts.env },
-        maxBuffer: 64 * 1024 * 1024,
-    });
-    if (r.status !== 0) {
-        throw new Error(`git ${args[0]} failed: ${(r.stderr?.toString() ?? "").trim().slice(0, 500)}`);
-    }
-    return r.stdout.toString();
-}
-export function repoExists(tenant, scope) {
-    return fs.existsSync(path.join(repoDir(tenant, scope), "HEAD"));
-}
-/** Create the repository if it is not there. Idempotent. */
-export function ensureRepo(tenant, scope) {
-    const dir = repoDir(tenant, scope);
-    if (!fs.existsSync(path.join(dir, "HEAD"))) {
-        fs.mkdirSync(path.dirname(dir), { recursive: true });
-        spawnSync("git", ["init", "--bare", "--quiet", "--initial-branch=main", dir], { stdio: "ignore" });
-        // Pushes over HTTP need this; it is the one config a bare remote wants.
-        git(dir, ["config", "http.receivepack", "true"]);
-    }
-    installHooks(dir);
-    return dir;
-}
-export function headSha(tenant, scope, ref = "refs/heads/main") {
-    if (!repoExists(tenant, scope))
-        return null;
-    const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "rev-parse", "--verify", "--quiet", ref]);
-    return r.status === 0 ? r.stdout.toString().trim() : null;
-}
-/**
- * Apply a change set as one commit on main, using plumbing against a scratch
- * index seeded from HEAD. No working copy, no checkout: each changed path is
- * hashed straight from its content into the object store.
- *
- * Returns the new commit, or null when the tree did not change.
- */
-export function commitChanges(tenant, scope, files, meta = {}) {
-    const dir = ensureRepo(tenant, scope);
-    const parent = headSha(tenant, scope);
-    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-index-"));
-    const index = path.join(scratch, "index");
-    // update-index insists on a work tree even when every entry arrives as
-    // --cacheinfo and nothing on disk is read. The scratch directory is one.
-    const env = { GIT_INDEX_FILE: index, GIT_WORK_TREE: scratch };
-    try {
-        if (parent)
-            git(dir, ["read-tree", parent], { env });
-        for (const f of files) {
-            if (f.after === null) {
-                if (parent)
-                    git(dir, ["update-index", "--force-remove", "--", f.path], { env });
-                continue;
-            }
-            const blob = git(dir, ["hash-object", "-w", "--stdin"], { input: f.after }).trim();
-            // Executable where code lives, matching what the writers chmod on disk.
-            const mode = /\.(py|sh|mjs|js|rb)$/.test(f.path) && /(^|\/)(scripts|tools)\//.test(f.path) ? "100755" : "100644";
-            git(dir, ["update-index", "--add", "--cacheinfo", `${mode},${blob},${f.path}`], { env });
-        }
-        const tree = git(dir, ["write-tree"], { env }).trim();
-        if (parent && git(dir, ["rev-parse", `${parent}^{tree}`]).trim() === tree)
-            return null;
-        const who = meta.by ?? "system";
-        const email = who.includes("@") ? who : `${who}@foldrun`;
-        const name = who.includes("@") ? who.split("@")[0] : who;
-        const date = meta.at ? new Date(meta.at).toISOString() : new Date().toISOString();
-        const commit = git(dir, ["commit-tree", tree, ...(parent ? ["-p", parent] : []), "-m", meta.message ?? describe(files)], {
-            env: {
-                GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-                GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-            },
-        }).trim();
-        git(dir, ["update-ref", "refs/heads/main", commit, ...(parent ? [parent] : [])]);
-        return commit;
-    }
-    finally {
-        fs.rmSync(scratch, { recursive: true, force: true });
-    }
-}
-function describe(files) {
-    if (files.length === 1) {
-        const f = files[0];
-        return `${f.before === null ? "created" : f.after === null ? "deleted" : "edited"} ${f.path}`;
-    }
-    return `changed ${files.length} files`;
-}
-// ------------------------------------------------------------------ reading
-const SEP = "";
-/** Commits on main, newest first, as the same summary the journal gave. */
-export function listCommits(tenant, scope, opts = {}) {
-    if (!headSha(tenant, scope, opts.ref))
-        return [];
-    const dir = repoDir(tenant, scope);
-    const out = git(dir, [
-        "log",
-        opts.ref ?? "refs/heads/main",
-        `--max-count=${opts.limit ?? 200}`,
-        `--format=%H${SEP}%aI${SEP}%ae${SEP}%s`,
-        "--name-only",
-        ...(opts.forPath ? ["--", opts.forPath] : []),
-    ]);
-    const rows = [];
-    let current = null;
-    for (const line of out.split("\n")) {
-        if (line.includes(SEP)) {
-            const [id, at, by, message] = line.split(SEP);
-            current = { id, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message, commit: id, paths: [] };
-            rows.push(current);
-        }
-        else if (line.trim() && current) {
-            current.paths.push(line.trim());
-        }
-    }
-    return rows;
-}
-/** One commit in full: every changed file with its before and after. */
-export function readCommit(tenant, scope, sha, forPath) {
-    if (!repoExists(tenant, scope) || !/^[0-9a-f]{4,40}$/.test(sha))
-        return null;
-    const dir = repoDir(tenant, scope);
-    const head = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${sha}^{commit}`]);
-    if (head.status !== 0)
-        return null;
-    const full = head.stdout.toString().trim();
-    const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%aI${SEP}%ae${SEP}%s`, full]).trim().split(SEP);
-    const hasParent = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", `${full}^`]).status === 0;
-    const names = git(dir, [
-        "diff-tree", "--no-commit-id", "--name-status", "-r", "--root", full,
-        ...(forPath ? ["--", forPath] : []),
-    ]);
-    const files = [];
-    for (const line of names.split("\n").filter(Boolean)) {
-        const [status, p] = line.split("\t");
-        const before = status === "A" || !hasParent ? null : blob(dir, `${full}^`, p);
-        const after = status === "D" ? null : blob(dir, full, p);
-        files.push({ path: p, before, after });
-    }
-    return {
-        id: full,
-        at,
-        by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by,
-        message: msg.join(SEP),
-        commit: full,
-        files,
-    };
-}
-function blob(dir, rev, p) {
-    const r = spawnSync("git", ["--git-dir", dir, "show", `${rev}:${p}`], { maxBuffer: 64 * 1024 * 1024 });
-    return r.status === 0 ? r.stdout.toString() : null;
-}
-export function listRefs(tenant, scope, kind) {
-    if (!repoExists(tenant, scope))
-        return [];
-    const out = git(repoDir(tenant, scope), [
-        "for-each-ref", `refs/${kind}`, "--sort=-committerdate",
-        `--format=%(refname:short)${SEP}%(objectname)${SEP}%(subject)${SEP}%(committerdate:iso-strict)`,
-    ]);
-    return out.split("\n").filter(Boolean).map((l) => {
-        const [name, sha, subject, at] = l.split(SEP);
-        return { name, sha, subject, at };
-    });
-}
-/**
- * The commit a restore means by `to`, on main's history:
- *
- *   a sha or a prefix of one      that commit
- *   a branch or tag name          where it points
- *   an ISO date or time           the last commit on main at or before it
- *   "3d", "12h", "90m", "2w"      the same, that long ago
- *
- * Null when nothing matches — before the first commit, or a name that is
- * not there. Throws on a `to` that cannot be any of these, so a typo is a
- * 400 rather than a silent "nothing found".
- */
-export function resolveRestorePoint(tenant, scope, to, now = Date.now()) {
-    const t = to.trim();
-    if (!t || t.startsWith("-"))
-        throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-    if (!headSha(tenant, scope))
-        return null;
-    const dir = repoDir(tenant, scope);
-    let sha = null;
-    const rel = /^(\d+)\s*(m|h|d|w)$/.exec(t);
-    const moment = rel
-        ? now - Number(rel[1]) * { m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 }[rel[2]]
-        : /^\d{4}-\d{2}-\d{2}/.test(t)
-            ? Date.parse(t)
-            : null;
-    if (moment !== null) {
-        if (Number.isNaN(moment))
-            throw Object.assign(new Error(`not a date: ${to}`), { status: 400 });
-        sha = git(dir, ["log", "-1", "--format=%H", `--until=@${Math.floor(moment / 1000)}`, "refs/heads/main"]).trim() || null;
-    }
-    else {
-        if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,120}$/.test(t))
-            throw Object.assign(new Error(`not a revision or a time: ${to}`), { status: 400 });
-        for (const ref of [/^[0-9a-f]{4,40}$/.test(t) ? `${t}^{commit}` : null, `refs/heads/${t}^{commit}`, `refs/tags/${t}^{commit}`]) {
-            if (!ref)
-                continue;
-            const r = spawnSync("git", ["--git-dir", dir, "rev-parse", "--verify", "--quiet", ref]);
-            if (r.status === 0) {
-                sha = r.stdout.toString().trim();
-                break;
-            }
-        }
-    }
-    if (!sha)
-        return null;
-    const [at, by, ...msg] = git(dir, ["log", "-1", `--format=%cI${SEP}%ae${SEP}%s`, sha]).trim().split(SEP);
-    return { sha, at, by: by.endsWith("@foldrun") ? by.replace(/@foldrun$/, "") : by, message: msg.join(SEP) };
-}
-/** The files at a commit, for a browser or a deploy. */
-export function listTree(tenant, scope, ref = "refs/heads/main") {
-    if (!headSha(tenant, scope, ref))
-        return [];
-    return git(repoDir(tenant, scope), ["ls-tree", "-r", "--format=%(objectmode) %(path)", ref])
-        .split("\n")
-        .filter(Boolean)
-        .map((l) => {
-        const [mode, ...rest] = l.split(" ");
-        return { mode, path: rest.join(" ") };
-    });
-}
-export function readBlob(tenant, scope, ref, p) {
-    if (!repoExists(tenant, scope))
-        return null;
-    return blob(repoDir(tenant, scope), ref, p);
-}
-/** The whole tree at a ref as deploy files — what a push turns into a workspace. */
-export function filesAt(tenant, scope, ref) {
-    const dir = repoDir(tenant, scope);
-    return listTree(tenant, scope, ref).flatMap((t) => {
-        const content = blob(dir, ref, t.path);
-        return content === null ? [] : [{ path: t.path, content }];
-    });
-}
-/**
- * What a ref would change on main: every file that differs, with both sides.
- * The branch's own commits are `listCommits({ ref })`; this is the net
- * effect, which is what a reviewer reads.
- */
-export function diffRefs(tenant, scope, base, head) {
-    if (!headSha(tenant, scope, base) || !headSha(tenant, scope, head))
-        return [];
-    const dir = repoDir(tenant, scope);
-    const out = git(dir, ["diff", "--name-status", `${base}...${head}`]);
-    return out.split("\n").filter(Boolean).map((line) => {
-        const [status, p] = line.split("\t");
-        return {
-            path: p,
-            before: status === "A" ? null : blob(dir, base, p),
-            after: status === "D" ? null : blob(dir, head, p),
-        };
-    });
-}
-/**
- * Merge a branch into main and return the new main. A fast-forward when it
- * is one; otherwise a merge commit whose tree is the BRANCH's — the branch
- * is what the person reviewed and chose, and a three-way textual merge of
- * markdown with no one to resolve conflicts would deploy text nobody wrote.
- * Both parents are recorded, so history shows the merge for what it was.
- */
-export function mergeBranch(tenant, scope, branch, meta = {}) {
-    const dir = repoDir(tenant, scope);
-    const main = headSha(tenant, scope);
-    const head = headSha(tenant, scope, `refs/heads/${safe(branch, "branch")}`);
-    if (!head)
-        throw new Error(`no branch "${branch}"`);
-    if (!main) {
-        git(dir, ["update-ref", "refs/heads/main", head]);
-        return { sha: head, fastForward: true };
-    }
-    const isAncestor = spawnSync("git", ["--git-dir", dir, "merge-base", "--is-ancestor", main, head]).status === 0;
-    if (isAncestor) {
-        git(dir, ["update-ref", "refs/heads/main", head, main]);
-        return { sha: head, fastForward: true };
-    }
-    const tree = git(dir, ["rev-parse", `${head}^{tree}`]).trim();
-    const who = meta.by ?? "foldrun";
-    const email = who.includes("@") ? who : `${who}@foldrun`;
-    const name = who.includes("@") ? who.split("@")[0] : who;
-    const date = new Date().toISOString();
-    const sha = git(dir, ["commit-tree", tree, "-p", main, "-p", head, "-m", `merge ${branch} into main`], {
-        env: {
-            GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_AUTHOR_DATE: date,
-            GIT_COMMITTER_NAME: "foldrun", GIT_COMMITTER_EMAIL: "platform@foldrun", GIT_COMMITTER_DATE: date,
-        },
-    }).trim();
-    git(dir, ["update-ref", "refs/heads/main", sha, main]);
-    return { sha, fastForward: false };
-}
-export function deleteBranch(tenant, scope, branch) {
-    if (branch === "main")
-        throw new Error("main is the default branch");
-    git(repoDir(tenant, scope), ["update-ref", "-d", `refs/heads/${safe(branch, "branch")}`]);
-}
-/** Push main to another remote — a GitHub or GitLab mirror. Blocking; callers
- *  run it off the request path. The token never touches disk: it is in the
- *  URL for this one process and nowhere else. */
-export function pushMirror(tenant, scope, url) {
-    if (!headSha(tenant, scope))
-        return { ok: false, detail: "nothing to push yet" };
-    const r = spawnSync("git", ["--git-dir", repoDir(tenant, scope), "push", "--quiet", url, "+refs/heads/main:refs/heads/main"], {
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
-        timeout: 60_000,
-    });
-    const detail = (r.stderr?.toString() ?? "").trim()
-        // Never echo the URL back: it carries the token.
-        .replaceAll(url, "<mirror>")
-        .slice(0, 500);
-    return { ok: r.status === 0, detail: r.status === 0 ? "pushed" : detail || "push failed" };
-}
-/**
- * Where the compiled pre-receive check is, found on disk rather than through
- * require.resolve — a bundler rewrites require.resolve("pkg") into a module
- * id, and the hook was once told to run a script called "51113". Searched
- * from the working directory upward: the monorepo layout, then an installed
- * package. Empty when there is no compiled check (a dev server on the source
- * tree), in which case a push is checked at deploy instead of refused — the
- * same rules, one step later.
- */
-export function hookScriptPath() {
-    let dir = process.cwd();
-    for (let i = 0; i < 6; i++) {
-        for (const rel of ["packages/core/dist/src/git-hook.js", "node_modules/@foldrun/core/dist/src/git-hook.js"]) {
-            const candidate = path.join(dir, rel);
-            if (fs.existsSync(candidate))
-                return candidate;
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return "";
-}
-/**
- * The pre-receive hook: a push that fails the deploy checks is refused with
- * the errors in the pusher's terminal, instead of accepted and then not
- * deployed. The hook shells out to node with the compiled check, so it runs
- * the same rules as a dashboard deploy; which node and which script are
- * passed in the environment by the HTTP route, because a hook inherits git's
- * environment and nothing else.
- */
-export function installHooks(dir) {
-    const hooks = path.join(dir, "hooks");
-    fs.mkdirSync(hooks, { recursive: true });
-    const hook = path.join(hooks, "pre-receive");
-    const script = `#!/bin/sh
-# Installed by foldrun. Refuses a push to main whose tree fails the checks.
-[ -n "$FOLDRUN_HOOK_NODE" ] && [ -n "$FOLDRUN_HOOK_SCRIPT" ] || exit 0
-exec "$FOLDRUN_HOOK_NODE" "$FOLDRUN_HOOK_SCRIPT"
-`;
-    if (!fs.existsSync(hook) || fs.readFileSync(hook, "utf8") !== script) {
-        fs.writeFileSync(hook, script, { mode: 0o755 });
-    }
-}

package/dist/src/tar.d.ts

@@ -1,30 +0,0 @@
-export interface TarEntry {
-    path: string;
-    content: Buffer;
-}
-/**
- * Every regular file in a gzipped tarball.
- *
- * Directories, symlinks, and pax/global headers are skipped: a workspace is
- * files, and following a link out of the archive is exactly the thing a deploy
- * from an untrusted repository must not do.
- */
-export declare function readTarGz(gz: Buffer): TarEntry[];
-/**
- * Drop the single wrapper directory an archive is rooted at.
- *
- * GitHub tarballs are rooted at `owner-repo-<sha>/`, which is not part of
- * anyone's workspace. Stripped only when *every* entry shares one first
- * segment, so an archive that is already flat is left alone.
- */
-export declare function stripRoot(entries: TarEntry[]): TarEntry[];
-/**
- * Read a tarball as the file list a deploy ships.
- *
- * `subdir` picks a workspace living inside a larger repository — the common
- * case, since a repo usually holds more than one thing.
- */
-export declare function filesFromTarball(gz: Buffer, subdir?: string): {
-    path: string;
-    content: string;
-}[];

package/dist/src/tar.js

@@ -1,112 +0,0 @@
-// Reading a .tar.gz, so a deploy can come from a GitHub tarball.
-//
-// `GET /repos/{owner}/{repo}/tarball/{sha}` is one HTTP call and needs no git
-// binary, no clone, and no working copy on the server — which is the whole
-// reason a markdown workspace can deploy from a webhook in a few hundred
-// milliseconds. What it returns is a tar.gz, and Node has gzip but not tar.
-//
-// Deliberately dependency-free, for the same reason the cron parser is: tar is
-// 512-byte blocks with an octal size field, and a reader is shorter than the
-// argument about which library to add.
-import zlib from "node:zlib";
-import { trimSlashes } from "./paths.js";
-const BLOCK = 512;
-const str = (b, off, len) => {
-    const raw = b.subarray(off, off + len);
-    const end = raw.indexOf(0);
-    return raw.subarray(0, end === -1 ? raw.length : end).toString("utf8");
-};
-// Sizes are octal, space- or NUL-padded. GNU also writes base-256 for large
-// files, flagged by the high bit — irrelevant for markdown, but a silent
-// misparse would be worse than a clear refusal.
-function size(b, off) {
-    if (b[off] & 0x80)
-        throw new Error("tar: base-256 size field is not supported");
-    const raw = str(b, off, 12).trim();
-    return raw ? parseInt(raw, 8) : 0;
-}
-/**
- * Every regular file in a gzipped tarball.
- *
- * Directories, symlinks, and pax/global headers are skipped: a workspace is
- * files, and following a link out of the archive is exactly the thing a deploy
- * from an untrusted repository must not do.
- */
-export function readTarGz(gz) {
-    const buf = zlib.gunzipSync(gz);
-    const out = [];
-    let longName = null;
-    for (let off = 0; off + BLOCK <= buf.length;) {
-        const header = buf.subarray(off, off + BLOCK);
-        // Two consecutive zero blocks end the archive; one is enough to stop.
-        if (header.every((b) => b === 0))
-            break;
-        const name = str(header, 0, 100);
-        const bytes = size(header, 124);
-        const type = String.fromCharCode(header[156]) || "0";
-        const prefix = str(header, 345, 155);
-        off += BLOCK;
-        const body = buf.subarray(off, off + bytes);
-        off += Math.ceil(bytes / BLOCK) * BLOCK;
-        // GNU long name: the next header's name lives in this entry's body.
-        if (type === "L") {
-            longName = body.toString("utf8").replace(/\0+$/, "");
-            continue;
-        }
-        if (type !== "0" && type !== "\0") {
-            longName = null;
-            continue;
-        }
-        const full = longName ?? (prefix ? `${prefix}/${name}` : name);
-        longName = null;
-        if (full)
-            out.push({ path: full, content: Buffer.from(body) });
-    }
-    return out;
-}
-/**
- * Drop the single wrapper directory an archive is rooted at.
- *
- * GitHub tarballs are rooted at `owner-repo-<sha>/`, which is not part of
- * anyone's workspace. Stripped only when *every* entry shares one first
- * segment, so an archive that is already flat is left alone.
- */
-export function stripRoot(entries) {
-    if (entries.length === 0)
-        return entries;
-    const first = entries[0].path.split("/")[0];
-    if (!entries.every((e) => e.path.split("/")[0] === first && e.path.includes("/"))) {
-        return entries;
-    }
-    return entries.map((e) => ({ ...e, path: e.path.slice(first.length + 1) }));
-}
-/**
- * Read a tarball as the file list a deploy ships.
- *
- * `subdir` picks a workspace living inside a larger repository — the common
- * case, since a repo usually holds more than one thing.
- */
-export function filesFromTarball(gz, subdir = "") {
-    const prefix = trimSlashes(subdir, "both");
-    const out = [];
-    for (const entry of stripRoot(readTarGz(gz))) {
-        let rel = entry.path;
-        if (prefix) {
-            if (!rel.startsWith(`${prefix}/`))
-                continue;
-            rel = rel.slice(prefix.length + 1);
-        }
-        // A tarball is untrusted input: an entry can name anything at all, and
-        // `../` in an archive is the oldest way to write outside the destination.
-        if (rel.split("/").includes("..") || rel.startsWith("/"))
-            continue;
-        // AppleDouble sidecars. macOS `tar` writes a `._name` beside every file to
-        // carry metadata no other system wants; they are not part of anyone's
-        // workspace, and letting one through means a deploy rejected for shipping
-        // a file the author never wrote.
-        if ((rel.split("/").pop() ?? "").startsWith("._"))
-            continue;
-        out.push({ path: rel, content: entry.content.toString("utf8") });
-    }
-    return out;
-}