@futdevpro/nts-dynamo 1.15.358 → 1.15.362

package/build/_collections/email-account.util.d.ts

@@ -0,0 +1,70 @@
+import { DyFM_Error } from '@futdevpro/fsm-dynamo';
+import { DyNTS_EmailService, DyNTS_EmailService_Settings, DyNTS_EmailTemplateComponent } from '../_services/core/email.service';
+/**
+ * BFR-OLDLIGHTSITE-010 — one SMTP account, named by a REFERENCE (an env-key prefix), resolved from the environment the
+ * FDP Keystore injects at runtime.
+ *
+ * @description `FDPNTS_emailCredentials` is bound to fixed `futdevpro.hu` accounts and fixed env keys, so a project
+ *   with its own mailboxes (Oldlight: `contact@`, `support@`, `auto@oldlightgames.com`) had no way to register an SMTP
+ *   transport without inventing a project-local secret flow. The Keystore already injects every secret as an env
+ *   variable (runner job injection, `fdp env-pull`), so a reference is simply the key PREFIX:
+ *
+ *   `credentialRef: 'OLS_SMTP_CONTACT'` → `OLS_SMTP_CONTACT_HOST`, `_PORT`, `_USER`, `_PASS`, optional `_SENDER_NAME`.
+ *
+ *   ⛔ This util never adds or invents keys: the project names them, and the values live in the Keystore
+ *   (`fdp-keystore-secrets`). ⛔ No value ever reaches a log, an error or a result — only key NAMES and states.
+ */
+export interface DyNTS_EmailAccountRef_Interface {
+    /** The env-key prefix of the account (letters, digits, underscore), e.g. `OLS_SMTP_CONTACT`. */
+    credentialRef: string;
+    /** Passed to `DyNTS_EmailService` (template root). */
+    rootPath: string;
+    templateComponents?: DyNTS_EmailTemplateComponent[];
+    /** The environment to read (default: `process.env`) — a test seam. */
+    env?: NodeJS.ProcessEnv;
+}
+/** What the reference resolved to. Carries key NAMES only — never a value. */
+export type DyNTS_EmailAccountResolution_Type = {
+    status: 'configured';
+    credentialRef: string;
+    settings: DyNTS_EmailService_Settings;
+} | {
+    status: 'absent';
+    credentialRef: string;
+    missingKeys: string[];
+} | {
+    status: 'invalid';
+    credentialRef: string;
+    problems: string[];
+};
+/** Keystore-ref based SMTP account bootstrap (BFR-OLDLIGHTSITE-010). */
+export declare class DyNTS_EmailAccount_Util {
+    /** The env-key names a reference expands to (`_SENDER_NAME` is optional). */
+    static keysOf(credentialRef: string): {
+        required: string[];
+        optional: string[];
+    };
+    /**
+     * Resolves the reference. `absent` = at least one required key is missing or empty (the account is simply not
+     * configured on this host → the caller answers 503); `invalid` = the keys are there but unusable (a wrong port, a
+     * user that is not an e-mail address). Never throws, never returns a value in a problem text.
+     */
+    static resolve(ref: DyNTS_EmailAccountRef_Interface): DyNTS_EmailAccountResolution_Type;
+    /**
+     * Creates the `DyNTS_EmailService` ONLY when the account resolves; otherwise returns `null` with the resolution, and
+     * logs WHICH keys are missing / wrong (names, never values). The service is not registered anywhere — the caller
+     * decides (e.g. its email-service collection).
+     */
+    static createEmailService(ref: DyNTS_EmailAccountRef_Interface): {
+        service: DyNTS_EmailService | null;
+        resolution: DyNTS_EmailAccountResolution_Type;
+    };
+    /**
+     * The degraded-mode error for a caller that needs the account NOW: 503, with the key NAMES the operator has to set in
+     * the Keystore (no value). `configured` → `null`.
+     */
+    static unavailableError(resolution: DyNTS_EmailAccountResolution_Type): DyFM_Error | null;
+    /** Key names / problems only — the one text that may reach a log or an error. */
+    private static describe;
+}
+//# sourceMappingURL=email-account.util.d.ts.map

package/build/_collections/email-account.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-account.util.d.ts","sourceRoot":"","sources":["../../src/_collections/email-account.util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAY,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,kBAAkB,EAAE,2BAA2B,EAAE,4BAA4B,EAC9E,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,+BAA+B;IAC9C,gGAAgG;IAChG,aAAa,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,4BAA4B,EAAE,CAAC;IACpD,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,8EAA8E;AAC9E,MAAM,MAAM,iCAAiC,GACzC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,2BAA2B,CAAA;CAAE,GACtF;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAKrE,wEAAwE;AACxE,qBAAa,uBAAuB;IAElC,6EAA6E;IAC7E,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE;IAOhF;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,+BAA+B,GAAG,iCAAiC;IAwDvF;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CACvB,GAAG,EAAE,+BAA+B,GACnC;QAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,iCAAiC,CAAA;KAAE;IAexF;;;OAGG;IACH,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,iCAAiC,GAAG,UAAU,GAAG,IAAI;IAczF,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,QAAQ;CAUxB"}

package/build/_collections/email-account.util.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_EmailAccount_Util = void 0;
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const email_service_1 = require("../_services/core/email.service");
+const global_settings_const_1 = require("./global-settings.const");
+/** The keys an account reference expands to (the required ones). */
+const REQUIRED_SUFFIXES = ['HOST', 'PORT', 'USER', 'PASS'];
+/** Keystore-ref based SMTP account bootstrap (BFR-OLDLIGHTSITE-010). */
+class DyNTS_EmailAccount_Util {
+    /** The env-key names a reference expands to (`_SENDER_NAME` is optional). */
+    static keysOf(credentialRef) {
+        return {
+            required: REQUIRED_SUFFIXES.map((suffix) => `${credentialRef}_${suffix}`),
+            optional: [`${credentialRef}_SENDER_NAME`],
+        };
+    }
+    /**
+     * Resolves the reference. `absent` = at least one required key is missing or empty (the account is simply not
+     * configured on this host → the caller answers 503); `invalid` = the keys are there but unusable (a wrong port, a
+     * user that is not an e-mail address). Never throws, never returns a value in a problem text.
+     */
+    static resolve(ref) {
+        const credentialRef = String(ref?.credentialRef ?? '');
+        if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(credentialRef)) {
+            return {
+                status: 'invalid',
+                credentialRef: credentialRef,
+                problems: ['the credentialRef must be an UPPER_SNAKE env-key prefix (e.g. OLS_SMTP_CONTACT)'],
+            };
+        }
+        const env = ref.env ?? process.env;
+        const read = (key) => String(env[key] ?? '').trim();
+        const keys = DyNTS_EmailAccount_Util.keysOf(credentialRef);
+        const missingKeys = keys.required.filter((key) => !read(key));
+        if (missingKeys.length) {
+            return { status: 'absent', credentialRef: credentialRef, missingKeys: missingKeys };
+        }
+        const host = read(`${credentialRef}_HOST`);
+        const portText = read(`${credentialRef}_PORT`);
+        const port = Number(portText);
+        const user = read(`${credentialRef}_USER`);
+        const problems = [];
+        if (!/^\d+$/.test(portText) || port < 1 || port > 65535) {
+            problems.push(`${credentialRef}_PORT is not a port number (1-65535)`);
+        }
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(user)) {
+            problems.push(`${credentialRef}_USER is not an e-mail address`);
+        }
+        if (/\s/.test(host)) {
+            problems.push(`${credentialRef}_HOST contains whitespace`);
+        }
+        if (problems.length) {
+            return { status: 'invalid', credentialRef: credentialRef, problems: problems };
+        }
+        return {
+            status: 'configured',
+            credentialRef: credentialRef,
+            settings: {
+                host: host,
+                port: port,
+                email: user,
+                // the password is NOT trimmed: surrounding spaces may be part of it
+                pass: String(env[`${credentialRef}_PASS`] ?? ''),
+                senderName: read(`${credentialRef}_SENDER_NAME`) || user,
+                rootPath: ref.rootPath,
+                templateComponents: ref.templateComponents,
+            },
+        };
+    }
+    /**
+     * Creates the `DyNTS_EmailService` ONLY when the account resolves; otherwise returns `null` with the resolution, and
+     * logs WHICH keys are missing / wrong (names, never values). The service is not registered anywhere — the caller
+     * decides (e.g. its email-service collection).
+     */
+    static createEmailService(ref) {
+        const resolution = DyNTS_EmailAccount_Util.resolve(ref);
+        if (resolution.status !== 'configured') {
+            fsm_dynamo_1.DyFM_Log.warn(`[DyNTS email-account] "${resolution.credentialRef}" is not usable (${resolution.status}): `
+                + DyNTS_EmailAccount_Util.describe(resolution));
+            return { service: null, resolution: resolution };
+        }
+        return { service: new email_service_1.DyNTS_EmailService(resolution.settings), resolution: resolution };
+    }
+    /**
+     * The degraded-mode error for a caller that needs the account NOW: 503, with the key NAMES the operator has to set in
+     * the Keystore (no value). `configured` → `null`.
+     */
+    static unavailableError(resolution) {
+        if (resolution.status === 'configured') {
+            return null;
+        }
+        return new fsm_dynamo_1.DyFM_Error({
+            status: 503,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-EMAIL-ACCOUNT-${resolution.status.toUpperCase()}`,
+            message: `SMTP account "${resolution.credentialRef}" is ${resolution.status}: `
+                + DyNTS_EmailAccount_Util.describe(resolution),
+            userMessage: 'E-mail sending is not available at the moment. Please try again later.',
+        });
+    }
+    /** Key names / problems only — the one text that may reach a log or an error. */
+    static describe(resolution) {
+        if (resolution.status === 'absent') {
+            return `missing Keystore keys: ${resolution.missingKeys.join(', ')}`;
+        }
+        if (resolution.status === 'invalid') {
+            return resolution.problems.join('; ');
+        }
+        return 'configured';
+    }
+}
+exports.DyNTS_EmailAccount_Util = DyNTS_EmailAccount_Util;
+//# sourceMappingURL=email-account.util.js.map

package/build/_collections/email-account.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-account.util.js","sourceRoot":"","sources":["../../src/_collections/email-account.util.ts"],"names":[],"mappings":";;;AAAA,sDAA6D;AAE7D,mEAEyC;AACzC,mEAAgE;AAgChE,oEAAoE;AACpE,MAAM,iBAAiB,GAAa,CAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAE,CAAC;AAEvE,wEAAwE;AACxE,MAAa,uBAAuB;IAElC,6EAA6E;IAC7E,MAAM,CAAC,MAAM,CAAC,aAAqB;QACjC,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,aAAa,IAAI,MAAM,EAAE,CAAC;YACzF,QAAQ,EAAE,CAAE,GAAG,aAAa,cAAc,CAAE;SAC7C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,GAAoC;QACjD,MAAM,aAAa,GAAW,MAAM,CAAC,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,aAAa,EAAE,aAAa;gBAC5B,QAAQ,EAAE,CAAE,iFAAiF,CAAE;aAChG,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAsB,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACtD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,GAA+C,uBAAuB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACvG,MAAM,WAAW,GAAa,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAEzF,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAW,IAAI,CAAC,GAAG,aAAa,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAW,IAAI,CAAC,GAAG,aAAa,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAW,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,GAAW,IAAI,CAAC,GAAG,aAAa,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,sCAAsC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,gCAAgC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACjF,CAAC;QAED,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,aAAa,EAAE,aAAa;YAC5B,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI;gBACX,oEAAoE;gBACpE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC;gBAChD,UAAU,EAAE,IAAI,CAAC,GAAG,aAAa,cAAc,CAAC,IAAI,IAAI;gBACxD,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;aAC3C;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CACvB,GAAoC;QAEpC,MAAM,UAAU,GAAsC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE3F,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACvC,qBAAQ,CAAC,IAAI,CACX,0BAA0B,UAAU,CAAC,aAAa,oBAAoB,UAAU,CAAC,MAAM,KAAK;kBAC1F,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/C,CAAC;YAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,kCAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IAC1F,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,gBAAgB,CAAC,UAA6C;QACnE,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,uBAAU,CAAC;YACpB,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,GAAG,6CAAqB,CAAC,mBAAmB,wBAAwB,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;YAChH,OAAO,EAAE,iBAAiB,UAAU,CAAC,aAAa,QAAQ,UAAU,CAAC,MAAM,IAAI;kBAC3E,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAChD,WAAW,EAAE,wEAAwE;SACtF,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,MAAM,CAAC,QAAQ,CAAC,UAA6C;QACnE,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,0BAA0B,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF;AA1HD,0DA0HC"}

package/build/_modules/git-sync/_models/git-sync.interface.d.ts

@@ -0,0 +1,94 @@
+/** BFR-OLDLIGHTSITE-003 — one file the caller wants in the repository, byte-exact. */
+export interface DyNTS_GitSyncFile_Interface {
+    /** A repository-relative path with `/` separators (no `..`, no absolute path, nothing under `.git`). */
+    path: string;
+    /** Written exactly as given (UTF-8, no line-ending conversion). */
+    content: string;
+}
+/** BFR-OLDLIGHTSITE-003 — one `sync` call. */
+export interface DyNTS_GitSyncRequest_Interface {
+    files: DyNTS_GitSyncFile_Interface[];
+    /** The commit message of the ONE commit this call may create. */
+    message: string;
+    /**
+     * Directories the caller OWNS completely (e.g. `story-points`): a tracked file under them that is NOT in `files` is
+     * removed in the same commit. Nothing outside these directories is ever removed.
+     */
+    prune?: string[];
+}
+/** BFR-OLDLIGHTSITE-003 — one git command of the run log (no secret: the token never travels in arguments). */
+export interface DyNTS_GitSyncLogEntry_Interface {
+    step: string;
+    command: string;
+    exitCode: number;
+    ms: number;
+}
+/** BFR-OLDLIGHTSITE-003 — the outcome of a successful `sync`. */
+export interface DyNTS_GitSyncResult_Interface {
+    /** `pushed` = one new commit is on the remote branch; `unchanged` = the files already matched, nothing committed. */
+    status: 'pushed' | 'unchanged';
+    /** The remote branch head after the call (the new commit, or the unchanged head). */
+    commit: string;
+    /** Added or modified paths, sorted. */
+    changedFiles: string[];
+    /** Paths removed through `prune`, sorted. */
+    removedFiles: string[];
+    /** 1, or 2 when the first push was rejected because the remote moved meanwhile. */
+    attempts: number;
+    durationMs: number;
+    log: DyNTS_GitSyncLogEntry_Interface[];
+}
+/** What a git command returned. */
+export interface DyNTS_GitRunResult_Interface {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/** Runs `git <args>` — the default spawns the git binary; a test can wrap or replace it. */
+export type DyNTS_GitRunner_Type = (args: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    timeoutMs: number;
+}) => Promise<DyNTS_GitRunResult_Interface>;
+/** BFR-OLDLIGHTSITE-003 — one synchronised repository. */
+export interface DyNTS_GitSync_Settings_Interface {
+    /** `https://…` (then `credentialRef` is required) or `file://…`. ⛔ Never with credentials inside the URL. */
+    repoUrl: string;
+    /** The branch to follow and push (it must already exist on the remote). */
+    branch: string;
+    /**
+     * A directory OWNED by this service: it is cloned on first use and force-reset to the remote branch on every call.
+     * An existing directory that is not a clone of `repoUrl` is refused, never touched.
+     */
+    workdir: string;
+    /** The env-key prefix of the token: `OLS_ARCHIVE_GIT` → `OLS_ARCHIVE_GIT_TOKEN` (injected by the FDP Keystore). */
+    credentialRef?: string;
+    /** The HTTP Basic user sent with the token (default `x-access-token` — GitHub accepts it for PATs and app tokens). */
+    tokenUser?: string;
+    author: {
+        name: string;
+        email: string;
+    };
+    /** The environment to read the token from (default `process.env`) — a test seam. */
+    env?: NodeJS.ProcessEnv;
+    runner?: DyNTS_GitRunner_Type;
+    /** Per git command (default 120 000 ms). */
+    timeoutMs?: number;
+}
+/** What `credentialRef` resolved to. Carries key NAMES only — never a value. */
+export type DyNTS_GitSyncCredential_Type = {
+    status: 'none';
+} | {
+    status: 'configured';
+    credentialRef: string;
+    tokenKey: string;
+} | {
+    status: 'absent';
+    credentialRef: string;
+    missingKeys: string[];
+} | {
+    status: 'invalid';
+    credentialRef: string;
+    problems: string[];
+};
+//# sourceMappingURL=git-sync.interface.d.ts.map

package/build/_modules/git-sync/_models/git-sync.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/git-sync/_models/git-sync.interface.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,WAAW,2BAA2B;IAC1C,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACrC,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+GAA+G;AAC/G,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,iEAAiE;AACjE,MAAM,WAAW,6BAA6B;IAC5C,qHAAqH;IACrH,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC/B,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,+BAA+B,EAAE,CAAC;CACxC;AAED,mCAAmC;AACnC,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAChE,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,WAAW,gCAAgC;IAC/C,6GAA6G;IAC7G,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mHAAmH;IACnH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sHAAsH;IACtH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,MAAM,MAAM,4BAA4B,GACpC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC"}

package/build/_modules/git-sync/_models/git-sync.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=git-sync.interface.js.map

package/build/_modules/git-sync/_models/git-sync.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync.interface.js","sourceRoot":"","sources":["../../../../src/_modules/git-sync/_models/git-sync.interface.ts"],"names":[],"mappings":""}

package/build/_modules/git-sync/git-sync-input.util.d.ts

@@ -0,0 +1,28 @@
+import { DyNTS_GitSync_Settings_Interface, DyNTS_GitSyncCredential_Type, DyNTS_GitSyncFile_Interface, DyNTS_GitSyncRequest_Interface } from './_models/git-sync.interface';
+/** A validated request: the message trimmed, the prune directories normalised and deduplicated. */
+export interface DyNTS_GitSyncPlan_Interface {
+    files: DyNTS_GitSyncFile_Interface[];
+    message: string;
+    prune: string[];
+}
+/**
+ * BFR-OLDLIGHTSITE-003 — everything checked BEFORE the first git command: the request (paths, message, prune
+ * directories), the settings (URL, branch, author) and the Keystore reference of the token.
+ *
+ * @description A bad input is a caller error (400) and never reaches git or the filesystem.
+ */
+export declare class DyNTS_GitSyncInput_Util {
+    /** The env-key a reference expands to. */
+    static keysOf(credentialRef: string): string[];
+    /** Resolves `credentialRef`; never throws and never returns the value. */
+    static resolveCredential(settings: DyNTS_GitSync_Settings_Interface): DyNTS_GitSyncCredential_Type;
+    /** Checks the settings; returns the problems (empty = usable). */
+    static settingsProblems(settings: DyNTS_GitSync_Settings_Interface): string[];
+    /** Validates and normalises a request, or throws a 400. */
+    static plan(request: DyNTS_GitSyncRequest_Interface): DyNTS_GitSyncPlan_Interface;
+    /** Why a repository-relative path is unsafe (null = safe). */
+    static pathProblem(path: unknown): string | null;
+    /** A conservative branch-name check (no option-like or ref-breaking names). */
+    static isSafeBranch(branch: string): boolean;
+}
+//# sourceMappingURL=git-sync-input.util.d.ts.map

package/build/_modules/git-sync/git-sync-input.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync-input.util.d.ts","sourceRoot":"","sources":["../../../src/_modules/git-sync/git-sync-input.util.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,gCAAgC,EAAE,4BAA4B,EAAE,2BAA2B,EAC3F,8BAA8B,EAC/B,MAAM,8BAA8B,CAAC;AAEtC,mGAAmG;AACnG,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,uBAAuB;IAElC,0CAA0C;IAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE;IAI9C,0EAA0E;IAC1E,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gCAAgC,GAAG,4BAA4B;IAyBlG,kEAAkE;IAClE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,gCAAgC,GAAG,MAAM,EAAE;IAqC7E,2DAA2D;IAC3D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,GAAG,2BAA2B;IAyDjF,8DAA8D;IAC9D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAuBhD,+EAA+E;IAC/E,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAK7C"}

package/build/_modules/git-sync/git-sync-input.util.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_GitSyncInput_Util = void 0;
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+/**
+ * BFR-OLDLIGHTSITE-003 — everything checked BEFORE the first git command: the request (paths, message, prune
+ * directories), the settings (URL, branch, author) and the Keystore reference of the token.
+ *
+ * @description A bad input is a caller error (400) and never reaches git or the filesystem.
+ */
+class DyNTS_GitSyncInput_Util {
+    /** The env-key a reference expands to. */
+    static keysOf(credentialRef) {
+        return [`${credentialRef}_TOKEN`];
+    }
+    /** Resolves `credentialRef`; never throws and never returns the value. */
+    static resolveCredential(settings) {
+        if (settings.credentialRef === undefined) {
+            return { status: 'none' };
+        }
+        const credentialRef = String(settings.credentialRef);
+        if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(credentialRef)) {
+            return {
+                status: 'invalid',
+                credentialRef: credentialRef,
+                problems: ['the credentialRef must be an UPPER_SNAKE env-key prefix (e.g. OLS_ARCHIVE_GIT)'],
+            };
+        }
+        const tokenKey = DyNTS_GitSyncInput_Util.keysOf(credentialRef)[0];
+        const env = settings.env ?? process.env;
+        if (!String(env[tokenKey] ?? '').trim()) {
+            return { status: 'absent', credentialRef: credentialRef, missingKeys: [tokenKey] };
+        }
+        return { status: 'configured', credentialRef: credentialRef, tokenKey: tokenKey };
+    }
+    /** Checks the settings; returns the problems (empty = usable). */
+    static settingsProblems(settings) {
+        const problems = [];
+        let url = null;
+        try {
+            url = new URL(String(settings?.repoUrl ?? ''));
+        }
+        catch {
+            problems.push('repoUrl is not a URL');
+        }
+        if (url) {
+            if (url.username || url.password) {
+                problems.push('repoUrl must not contain credentials — pass the token through credentialRef (the FDP Keystore)');
+            }
+            if (url.protocol === 'https:' && settings.credentialRef === undefined) {
+                problems.push('an https repoUrl needs a credentialRef');
+            }
+            if (url.protocol !== 'https:' && url.protocol !== 'file:') {
+                problems.push(`repoUrl protocol ${url.protocol} is not supported (https: or file:)`);
+            }
+        }
+        if (!DyNTS_GitSyncInput_Util.isSafeBranch(String(settings?.branch ?? ''))) {
+            problems.push('branch is not a safe branch name');
+        }
+        if (!String(settings?.workdir ?? '').trim()) {
+            problems.push('workdir is required');
+        }
+        const authorName = String(settings?.author?.name ?? '').trim();
+        if (!authorName || !/^[^\s@]+@[^\s@]+$/.test(String(settings?.author?.email ?? ''))) {
+            problems.push('author needs a name and an e-mail address');
+        }
+        return problems;
+    }
+    /** Validates and normalises a request, or throws a 400. */
+    static plan(request) {
+        const problems = [];
+        const files = Array.isArray(request?.files) ? request.files : [];
+        const seen = new Set();
+        if (!Array.isArray(request?.files)) {
+            problems.push('files must be an array');
+        }
+        files.forEach((file, index) => {
+            const problem = DyNTS_GitSyncInput_Util.pathProblem(file?.path);
+            if (problem) {
+                problems.push(`files[${index}]: ${problem}`);
+            }
+            else if (seen.has(file.path.toLowerCase())) {
+                // case-insensitive: two paths that differ only in case collide on Windows and macOS checkouts
+                problems.push(`files[${index}]: duplicate path ${file.path}`);
+            }
+            if (typeof file?.content !== 'string') {
+                problems.push(`files[${index}]: content must be a string`);
+            }
+            seen.add(String(file?.path ?? '').toLowerCase());
+        });
+        const prune = (request?.prune ?? []).map((dir) => String(dir ?? '').replace(/\/+$/, ''));
+        prune.forEach((dir, index) => {
+            const problem = DyNTS_GitSyncInput_Util.pathProblem(dir);
+            if (problem) {
+                problems.push(`prune[${index}]: ${problem}`);
+            }
+        });
+        const message = String(request?.message ?? '').trim();
+        if (!message || message.length > 10000) {
+            problems.push('message must be 1–10000 characters');
+        }
+        if (problems.length) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 400,
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-GITSYNC-IN0`,
+                message: `GitSync request rejected: ${problems.join('; ')}`,
+                userMessage: 'The files to synchronise are invalid.',
+                additionalContent: { problems: problems },
+            });
+        }
+        return {
+            files: files,
+            message: message,
+            prune: [...new Set(prune)].sort(),
+        };
+    }
+    /** Why a repository-relative path is unsafe (null = safe). */
+    static pathProblem(path) {
+        if (typeof path !== 'string' || !path) {
+            return 'the path is empty';
+        }
+        if (path.length > 400) {
+            return 'the path is longer than 400 characters';
+        }
+        if (/[\\:\0]/.test(path) || path.startsWith('/')) {
+            return `${path} is not a relative path with / separators`;
+        }
+        const segments = path.split('/');
+        if (segments.some((segment) => !segment || segment === '.' || segment === '..')) {
+            return `${path} has an empty, . or .. segment`;
+        }
+        if (segments.some((segment) => segment.toLowerCase() === '.git')) {
+            return `${path} is inside .git`;
+        }
+        return null;
+    }
+    /** A conservative branch-name check (no option-like or ref-breaking names). */
+    static isSafeBranch(branch) {
+        return /^[A-Za-z0-9._/-]{1,200}$/.test(branch)
+            && !branch.startsWith('-') && !branch.startsWith('/') && !branch.endsWith('/')
+            && !branch.includes('..') && !branch.includes('//') && !branch.endsWith('.lock') && !branch.endsWith('.');
+    }
+}
+exports.DyNTS_GitSyncInput_Util = DyNTS_GitSyncInput_Util;
+//# sourceMappingURL=git-sync-input.util.js.map

package/build/_modules/git-sync/git-sync-input.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync-input.util.js","sourceRoot":"","sources":["../../../src/_modules/git-sync/git-sync-input.util.ts"],"names":[],"mappings":";;;AAAA,sDAAmD;AAEnD,oFAAiF;AAajF;;;;;GAKG;AACH,MAAa,uBAAuB;IAElC,0CAA0C;IAC1C,MAAM,CAAC,MAAM,CAAC,aAAqB;QACjC,OAAO,CAAE,GAAG,aAAa,QAAQ,CAAE,CAAC;IACtC,CAAC;IAED,0EAA0E;IAC1E,MAAM,CAAC,iBAAiB,CAAC,QAA0C;QACjE,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAW,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAE7D,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,aAAa,EAAE,aAAa;gBAC5B,QAAQ,EAAE,CAAE,gFAAgF,CAAE;aAC/F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAW,uBAAuB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,CAAE,QAAQ,CAAE,EAAE,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACpF,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,gBAAgB,CAAC,QAA0C;QAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,GAAG,GAAe,IAAI,CAAC;QAE3B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;YAClH,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtE,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,QAAQ,qCAAqC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1E,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,UAAU,GAAW,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEvE,IAAI,CAAC,UAAU,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,IAAI,CAAC,OAAuC;QACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAkC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAiC,EAAE,KAAa,EAAQ,EAAE;YACvE,MAAM,OAAO,GAAkB,uBAAuB,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAE/E,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC7C,8FAA8F;gBAC9F,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,6BAA6B,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAa,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAEnH,KAAK,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;YACjD,MAAM,OAAO,GAAkB,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAExE,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAW,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,uBAAU,CAAC;gBACnB,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,GAAG,6CAAqB,CAAC,mBAAmB,oBAAoB;gBAC3E,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,WAAW,EAAE,uCAAuC;gBACpD,iBAAiB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,CAAE,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAE,CAAC,IAAI,EAAE;SAC5C,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,WAAW,CAAC,IAAa;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtB,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,IAAI,2CAA2C,CAAC;QAC5D,CAAC;QAED,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;YACjG,OAAO,GAAG,IAAI,gCAAgC,CAAC;QACjD,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,GAAG,IAAI,iBAAiB,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,YAAY,CAAC,MAAc;QAChC,OAAO,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC;eACzC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;eAC3E,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9G,CAAC;CACF;AA/JD,0DA+JC"}

package/build/_modules/git-sync/git-sync.service.d.ts

@@ -0,0 +1,54 @@
+import { DyNTS_GitRunner_Type, DyNTS_GitSync_Settings_Interface, DyNTS_GitSyncRequest_Interface, DyNTS_GitSyncResult_Interface } from './_models/git-sync.interface';
+/**
+ * BFR-OLDLIGHTSITE-003 — synchronises a caller-built file set into a git repository as ONE commit, pushed.
+ *
+ * @description Per call: clone (first use) or fetch → force-reset the owned workdir to the remote branch → write the
+ *   files byte-exact → remove tracked files the caller no longer lists under its `prune` directories → ONE commit →
+ *   push (fast-forward only: a push is never forced). Nothing changed → no commit (`unchanged`). The remote moved
+ *   between fetch and push → the whole step runs once more on the new head.
+ *
+ *   The token (`<credentialRef>_TOKEN`, FDP Keystore) reaches git ONLY as an environment-scoped `http.extraHeader`
+ *   (`GIT_CONFIG_*`): never in an argument (visible in the process list), never in the URL, never in `.git/config`.
+ *   Every error text is redacted — the token literal included.
+ */
+export declare class DyNTS_GitSync_Service {
+    private readonly settings;
+    private readonly runner;
+    private readonly timeoutMs;
+    /** The calls of this instance run one after another — they share one workdir. */
+    private queue;
+    /** Validates the settings (a 400 on a configuration error); the token is only read when `sync` runs. */
+    constructor(settings: DyNTS_GitSync_Settings_Interface);
+    /** The default runner: the `git` binary, no shell, bounded time and output. */
+    static readonly defaultRunner: DyNTS_GitRunner_Type;
+    /**
+     * One synchronisation step — see the class description. Concurrent calls on the same instance are queued (one
+     * workdir); ⚠️ two INSTANCES or processes must not share a workdir.
+     */
+    sync(request: DyNTS_GitSyncRequest_Interface): Promise<DyNTS_GitSyncResult_Interface>;
+    private syncNow;
+    /** Clone on first use; otherwise verify the clone's origin, fetch and force-reset to the remote branch. */
+    private prepareWorkdir;
+    /** Writes every file byte-exact; a symbolic link on the way is refused (it could point outside the workdir). */
+    private writeFiles;
+    /** Removes the tracked files under the prune directories that the caller no longer lists. */
+    private pruneFiles;
+    /** The absolute path of a repository-relative one — and a last check that it stays inside the workdir. */
+    private inside;
+    /** Refuses a path whose existing parent is a symbolic link. */
+    private assertNoLink;
+    /** `git diff --name-status -z` → added/modified and deleted paths, sorted. */
+    private parseNameStatus;
+    private head;
+    /** The child environment: no prompt, and the token — if any — as an URL-scoped extra header. */
+    private gitEnv;
+    /** Values that must never appear in a log or error text (the token and its header form). */
+    private secrets;
+    /** Runs one git command, logs it, and throws a rich, redacted error on failure (unless `allowFailure`). */
+    private git;
+    private failure;
+    private refusal;
+    /** The generic secret redaction, plus the literal token values of this sync. */
+    private redact;
+}
+//# sourceMappingURL=git-sync.service.d.ts.map

package/build/_modules/git-sync/git-sync.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync.service.d.ts","sourceRoot":"","sources":["../../../src/_modules/git-sync/git-sync.service.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,oBAAoB,EAAgC,gCAAgC,EACtB,8BAA8B,EAC5F,6BAA6B,EAC9B,MAAM,8BAA8B,CAAC;AAWtC;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,iFAAiF;IACjF,OAAO,CAAC,KAAK,CAAuC;IAEpD,wGAAwG;gBAC5F,QAAQ,EAAE,gCAAgC;IAkBtD,+EAA+E;IAC/E,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAcjD;IAEF;;;OAGG;IACG,IAAI,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,6BAA6B,CAAC;YA0B7E,OAAO;IAuDrB,2GAA2G;YAC7F,cAAc;IAkC5B,gHAAgH;YAClG,UAAU;IAUxB,6FAA6F;YAC/E,UAAU;IAsBxB,0GAA0G;IAC1G,OAAO,CAAC,MAAM;IAUd,+DAA+D;YACjD,YAAY;IAc1B,8EAA8E;IAC9E,OAAO,CAAC,eAAe;YAYT,IAAI;IAIlB,gGAAgG;IAChG,OAAO,CAAC,MAAM;IA8Bd,4FAA4F;IAC5F,OAAO,CAAC,OAAO,CAAgB;IAE/B,2GAA2G;YAC7F,GAAG;IAoBjB,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,OAAO;IAUf,gFAAgF;IAChF,OAAO,CAAC,MAAM;CAMf"}