@futdevpro/nts-dynamo 1.15.359 → 1.15.362

package/build/_modules/git-sync/_models/git-sync.interface.d.ts

@@ -0,0 +1,94 @@
+/** BFR-OLDLIGHTSITE-003 — one file the caller wants in the repository, byte-exact. */
+export interface DyNTS_GitSyncFile_Interface {
+    /** A repository-relative path with `/` separators (no `..`, no absolute path, nothing under `.git`). */
+    path: string;
+    /** Written exactly as given (UTF-8, no line-ending conversion). */
+    content: string;
+}
+/** BFR-OLDLIGHTSITE-003 — one `sync` call. */
+export interface DyNTS_GitSyncRequest_Interface {
+    files: DyNTS_GitSyncFile_Interface[];
+    /** The commit message of the ONE commit this call may create. */
+    message: string;
+    /**
+     * Directories the caller OWNS completely (e.g. `story-points`): a tracked file under them that is NOT in `files` is
+     * removed in the same commit. Nothing outside these directories is ever removed.
+     */
+    prune?: string[];
+}
+/** BFR-OLDLIGHTSITE-003 — one git command of the run log (no secret: the token never travels in arguments). */
+export interface DyNTS_GitSyncLogEntry_Interface {
+    step: string;
+    command: string;
+    exitCode: number;
+    ms: number;
+}
+/** BFR-OLDLIGHTSITE-003 — the outcome of a successful `sync`. */
+export interface DyNTS_GitSyncResult_Interface {
+    /** `pushed` = one new commit is on the remote branch; `unchanged` = the files already matched, nothing committed. */
+    status: 'pushed' | 'unchanged';
+    /** The remote branch head after the call (the new commit, or the unchanged head). */
+    commit: string;
+    /** Added or modified paths, sorted. */
+    changedFiles: string[];
+    /** Paths removed through `prune`, sorted. */
+    removedFiles: string[];
+    /** 1, or 2 when the first push was rejected because the remote moved meanwhile. */
+    attempts: number;
+    durationMs: number;
+    log: DyNTS_GitSyncLogEntry_Interface[];
+}
+/** What a git command returned. */
+export interface DyNTS_GitRunResult_Interface {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/** Runs `git <args>` — the default spawns the git binary; a test can wrap or replace it. */
+export type DyNTS_GitRunner_Type = (args: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    timeoutMs: number;
+}) => Promise<DyNTS_GitRunResult_Interface>;
+/** BFR-OLDLIGHTSITE-003 — one synchronised repository. */
+export interface DyNTS_GitSync_Settings_Interface {
+    /** `https://…` (then `credentialRef` is required) or `file://…`. ⛔ Never with credentials inside the URL. */
+    repoUrl: string;
+    /** The branch to follow and push (it must already exist on the remote). */
+    branch: string;
+    /**
+     * A directory OWNED by this service: it is cloned on first use and force-reset to the remote branch on every call.
+     * An existing directory that is not a clone of `repoUrl` is refused, never touched.
+     */
+    workdir: string;
+    /** The env-key prefix of the token: `OLS_ARCHIVE_GIT` → `OLS_ARCHIVE_GIT_TOKEN` (injected by the FDP Keystore). */
+    credentialRef?: string;
+    /** The HTTP Basic user sent with the token (default `x-access-token` — GitHub accepts it for PATs and app tokens). */
+    tokenUser?: string;
+    author: {
+        name: string;
+        email: string;
+    };
+    /** The environment to read the token from (default `process.env`) — a test seam. */
+    env?: NodeJS.ProcessEnv;
+    runner?: DyNTS_GitRunner_Type;
+    /** Per git command (default 120 000 ms). */
+    timeoutMs?: number;
+}
+/** What `credentialRef` resolved to. Carries key NAMES only — never a value. */
+export type DyNTS_GitSyncCredential_Type = {
+    status: 'none';
+} | {
+    status: 'configured';
+    credentialRef: string;
+    tokenKey: string;
+} | {
+    status: 'absent';
+    credentialRef: string;
+    missingKeys: string[];
+} | {
+    status: 'invalid';
+    credentialRef: string;
+    problems: string[];
+};
+//# sourceMappingURL=git-sync.interface.d.ts.map

package/build/_modules/git-sync/_models/git-sync.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/git-sync/_models/git-sync.interface.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,WAAW,2BAA2B;IAC1C,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACrC,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+GAA+G;AAC/G,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,iEAAiE;AACjE,MAAM,WAAW,6BAA6B;IAC5C,qHAAqH;IACrH,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC/B,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,+BAA+B,EAAE,CAAC;CACxC;AAED,mCAAmC;AACnC,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAChE,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,WAAW,gCAAgC;IAC/C,6GAA6G;IAC7G,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mHAAmH;IACnH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sHAAsH;IACtH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,MAAM,MAAM,4BAA4B,GACpC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC"}

package/build/_modules/git-sync/_models/git-sync.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=git-sync.interface.js.map

package/build/_modules/git-sync/_models/git-sync.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync.interface.js","sourceRoot":"","sources":["../../../../src/_modules/git-sync/_models/git-sync.interface.ts"],"names":[],"mappings":""}

package/build/_modules/git-sync/git-sync-input.util.d.ts

@@ -0,0 +1,28 @@
+import { DyNTS_GitSync_Settings_Interface, DyNTS_GitSyncCredential_Type, DyNTS_GitSyncFile_Interface, DyNTS_GitSyncRequest_Interface } from './_models/git-sync.interface';
+/** A validated request: the message trimmed, the prune directories normalised and deduplicated. */
+export interface DyNTS_GitSyncPlan_Interface {
+    files: DyNTS_GitSyncFile_Interface[];
+    message: string;
+    prune: string[];
+}
+/**
+ * BFR-OLDLIGHTSITE-003 — everything checked BEFORE the first git command: the request (paths, message, prune
+ * directories), the settings (URL, branch, author) and the Keystore reference of the token.
+ *
+ * @description A bad input is a caller error (400) and never reaches git or the filesystem.
+ */
+export declare class DyNTS_GitSyncInput_Util {
+    /** The env-key a reference expands to. */
+    static keysOf(credentialRef: string): string[];
+    /** Resolves `credentialRef`; never throws and never returns the value. */
+    static resolveCredential(settings: DyNTS_GitSync_Settings_Interface): DyNTS_GitSyncCredential_Type;
+    /** Checks the settings; returns the problems (empty = usable). */
+    static settingsProblems(settings: DyNTS_GitSync_Settings_Interface): string[];
+    /** Validates and normalises a request, or throws a 400. */
+    static plan(request: DyNTS_GitSyncRequest_Interface): DyNTS_GitSyncPlan_Interface;
+    /** Why a repository-relative path is unsafe (null = safe). */
+    static pathProblem(path: unknown): string | null;
+    /** A conservative branch-name check (no option-like or ref-breaking names). */
+    static isSafeBranch(branch: string): boolean;
+}
+//# sourceMappingURL=git-sync-input.util.d.ts.map

package/build/_modules/git-sync/git-sync-input.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync-input.util.d.ts","sourceRoot":"","sources":["../../../src/_modules/git-sync/git-sync-input.util.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,gCAAgC,EAAE,4BAA4B,EAAE,2BAA2B,EAC3F,8BAA8B,EAC/B,MAAM,8BAA8B,CAAC;AAEtC,mGAAmG;AACnG,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,uBAAuB;IAElC,0CAA0C;IAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE;IAI9C,0EAA0E;IAC1E,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gCAAgC,GAAG,4BAA4B;IAyBlG,kEAAkE;IAClE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,gCAAgC,GAAG,MAAM,EAAE;IAqC7E,2DAA2D;IAC3D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,GAAG,2BAA2B;IAyDjF,8DAA8D;IAC9D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAuBhD,+EAA+E;IAC/E,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAK7C"}

package/build/_modules/git-sync/git-sync-input.util.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_GitSyncInput_Util = void 0;
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+/**
+ * BFR-OLDLIGHTSITE-003 — everything checked BEFORE the first git command: the request (paths, message, prune
+ * directories), the settings (URL, branch, author) and the Keystore reference of the token.
+ *
+ * @description A bad input is a caller error (400) and never reaches git or the filesystem.
+ */
+class DyNTS_GitSyncInput_Util {
+    /** The env-key a reference expands to. */
+    static keysOf(credentialRef) {
+        return [`${credentialRef}_TOKEN`];
+    }
+    /** Resolves `credentialRef`; never throws and never returns the value. */
+    static resolveCredential(settings) {
+        if (settings.credentialRef === undefined) {
+            return { status: 'none' };
+        }
+        const credentialRef = String(settings.credentialRef);
+        if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(credentialRef)) {
+            return {
+                status: 'invalid',
+                credentialRef: credentialRef,
+                problems: ['the credentialRef must be an UPPER_SNAKE env-key prefix (e.g. OLS_ARCHIVE_GIT)'],
+            };
+        }
+        const tokenKey = DyNTS_GitSyncInput_Util.keysOf(credentialRef)[0];
+        const env = settings.env ?? process.env;
+        if (!String(env[tokenKey] ?? '').trim()) {
+            return { status: 'absent', credentialRef: credentialRef, missingKeys: [tokenKey] };
+        }
+        return { status: 'configured', credentialRef: credentialRef, tokenKey: tokenKey };
+    }
+    /** Checks the settings; returns the problems (empty = usable). */
+    static settingsProblems(settings) {
+        const problems = [];
+        let url = null;
+        try {
+            url = new URL(String(settings?.repoUrl ?? ''));
+        }
+        catch {
+            problems.push('repoUrl is not a URL');
+        }
+        if (url) {
+            if (url.username || url.password) {
+                problems.push('repoUrl must not contain credentials — pass the token through credentialRef (the FDP Keystore)');
+            }
+            if (url.protocol === 'https:' && settings.credentialRef === undefined) {
+                problems.push('an https repoUrl needs a credentialRef');
+            }
+            if (url.protocol !== 'https:' && url.protocol !== 'file:') {
+                problems.push(`repoUrl protocol ${url.protocol} is not supported (https: or file:)`);
+            }
+        }
+        if (!DyNTS_GitSyncInput_Util.isSafeBranch(String(settings?.branch ?? ''))) {
+            problems.push('branch is not a safe branch name');
+        }
+        if (!String(settings?.workdir ?? '').trim()) {
+            problems.push('workdir is required');
+        }
+        const authorName = String(settings?.author?.name ?? '').trim();
+        if (!authorName || !/^[^\s@]+@[^\s@]+$/.test(String(settings?.author?.email ?? ''))) {
+            problems.push('author needs a name and an e-mail address');
+        }
+        return problems;
+    }
+    /** Validates and normalises a request, or throws a 400. */
+    static plan(request) {
+        const problems = [];
+        const files = Array.isArray(request?.files) ? request.files : [];
+        const seen = new Set();
+        if (!Array.isArray(request?.files)) {
+            problems.push('files must be an array');
+        }
+        files.forEach((file, index) => {
+            const problem = DyNTS_GitSyncInput_Util.pathProblem(file?.path);
+            if (problem) {
+                problems.push(`files[${index}]: ${problem}`);
+            }
+            else if (seen.has(file.path.toLowerCase())) {
+                // case-insensitive: two paths that differ only in case collide on Windows and macOS checkouts
+                problems.push(`files[${index}]: duplicate path ${file.path}`);
+            }
+            if (typeof file?.content !== 'string') {
+                problems.push(`files[${index}]: content must be a string`);
+            }
+            seen.add(String(file?.path ?? '').toLowerCase());
+        });
+        const prune = (request?.prune ?? []).map((dir) => String(dir ?? '').replace(/\/+$/, ''));
+        prune.forEach((dir, index) => {
+            const problem = DyNTS_GitSyncInput_Util.pathProblem(dir);
+            if (problem) {
+                problems.push(`prune[${index}]: ${problem}`);
+            }
+        });
+        const message = String(request?.message ?? '').trim();
+        if (!message || message.length > 10000) {
+            problems.push('message must be 1–10000 characters');
+        }
+        if (problems.length) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 400,
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-GITSYNC-IN0`,
+                message: `GitSync request rejected: ${problems.join('; ')}`,
+                userMessage: 'The files to synchronise are invalid.',
+                additionalContent: { problems: problems },
+            });
+        }
+        return {
+            files: files,
+            message: message,
+            prune: [...new Set(prune)].sort(),
+        };
+    }
+    /** Why a repository-relative path is unsafe (null = safe). */
+    static pathProblem(path) {
+        if (typeof path !== 'string' || !path) {
+            return 'the path is empty';
+        }
+        if (path.length > 400) {
+            return 'the path is longer than 400 characters';
+        }
+        if (/[\\:\0]/.test(path) || path.startsWith('/')) {
+            return `${path} is not a relative path with / separators`;
+        }
+        const segments = path.split('/');
+        if (segments.some((segment) => !segment || segment === '.' || segment === '..')) {
+            return `${path} has an empty, . or .. segment`;
+        }
+        if (segments.some((segment) => segment.toLowerCase() === '.git')) {
+            return `${path} is inside .git`;
+        }
+        return null;
+    }
+    /** A conservative branch-name check (no option-like or ref-breaking names). */
+    static isSafeBranch(branch) {
+        return /^[A-Za-z0-9._/-]{1,200}$/.test(branch)
+            && !branch.startsWith('-') && !branch.startsWith('/') && !branch.endsWith('/')
+            && !branch.includes('..') && !branch.includes('//') && !branch.endsWith('.lock') && !branch.endsWith('.');
+    }
+}
+exports.DyNTS_GitSyncInput_Util = DyNTS_GitSyncInput_Util;
+//# sourceMappingURL=git-sync-input.util.js.map

package/build/_modules/git-sync/git-sync-input.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync-input.util.js","sourceRoot":"","sources":["../../../src/_modules/git-sync/git-sync-input.util.ts"],"names":[],"mappings":";;;AAAA,sDAAmD;AAEnD,oFAAiF;AAajF;;;;;GAKG;AACH,MAAa,uBAAuB;IAElC,0CAA0C;IAC1C,MAAM,CAAC,MAAM,CAAC,aAAqB;QACjC,OAAO,CAAE,GAAG,aAAa,QAAQ,CAAE,CAAC;IACtC,CAAC;IAED,0EAA0E;IAC1E,MAAM,CAAC,iBAAiB,CAAC,QAA0C;QACjE,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAW,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAE7D,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,aAAa,EAAE,aAAa;gBAC5B,QAAQ,EAAE,CAAE,gFAAgF,CAAE;aAC/F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAW,uBAAuB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,CAAE,QAAQ,CAAE,EAAE,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACpF,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,gBAAgB,CAAC,QAA0C;QAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,GAAG,GAAe,IAAI,CAAC;QAE3B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;YAClH,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtE,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,QAAQ,qCAAqC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1E,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,UAAU,GAAW,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEvE,IAAI,CAAC,UAAU,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,IAAI,CAAC,OAAuC;QACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAkC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAiC,EAAE,KAAa,EAAQ,EAAE;YACvE,MAAM,OAAO,GAAkB,uBAAuB,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAE/E,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC7C,8FAA8F;gBAC9F,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,6BAA6B,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAa,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAEnH,KAAK,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;YACjD,MAAM,OAAO,GAAkB,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAExE,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAW,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,uBAAU,CAAC;gBACnB,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,GAAG,6CAAqB,CAAC,mBAAmB,oBAAoB;gBAC3E,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,WAAW,EAAE,uCAAuC;gBACpD,iBAAiB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,CAAE,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAE,CAAC,IAAI,EAAE;SAC5C,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,WAAW,CAAC,IAAa;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtB,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,IAAI,2CAA2C,CAAC;QAC5D,CAAC;QAED,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;YACjG,OAAO,GAAG,IAAI,gCAAgC,CAAC;QACjD,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAClF,OAAO,GAAG,IAAI,iBAAiB,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,YAAY,CAAC,MAAc;QAChC,OAAO,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC;eACzC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;eAC3E,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9G,CAAC;CACF;AA/JD,0DA+JC"}

package/build/_modules/git-sync/git-sync.service.d.ts

@@ -0,0 +1,54 @@
+import { DyNTS_GitRunner_Type, DyNTS_GitSync_Settings_Interface, DyNTS_GitSyncRequest_Interface, DyNTS_GitSyncResult_Interface } from './_models/git-sync.interface';
+/**
+ * BFR-OLDLIGHTSITE-003 — synchronises a caller-built file set into a git repository as ONE commit, pushed.
+ *
+ * @description Per call: clone (first use) or fetch → force-reset the owned workdir to the remote branch → write the
+ *   files byte-exact → remove tracked files the caller no longer lists under its `prune` directories → ONE commit →
+ *   push (fast-forward only: a push is never forced). Nothing changed → no commit (`unchanged`). The remote moved
+ *   between fetch and push → the whole step runs once more on the new head.
+ *
+ *   The token (`<credentialRef>_TOKEN`, FDP Keystore) reaches git ONLY as an environment-scoped `http.extraHeader`
+ *   (`GIT_CONFIG_*`): never in an argument (visible in the process list), never in the URL, never in `.git/config`.
+ *   Every error text is redacted — the token literal included.
+ */
+export declare class DyNTS_GitSync_Service {
+    private readonly settings;
+    private readonly runner;
+    private readonly timeoutMs;
+    /** The calls of this instance run one after another — they share one workdir. */
+    private queue;
+    /** Validates the settings (a 400 on a configuration error); the token is only read when `sync` runs. */
+    constructor(settings: DyNTS_GitSync_Settings_Interface);
+    /** The default runner: the `git` binary, no shell, bounded time and output. */
+    static readonly defaultRunner: DyNTS_GitRunner_Type;
+    /**
+     * One synchronisation step — see the class description. Concurrent calls on the same instance are queued (one
+     * workdir); ⚠️ two INSTANCES or processes must not share a workdir.
+     */
+    sync(request: DyNTS_GitSyncRequest_Interface): Promise<DyNTS_GitSyncResult_Interface>;
+    private syncNow;
+    /** Clone on first use; otherwise verify the clone's origin, fetch and force-reset to the remote branch. */
+    private prepareWorkdir;
+    /** Writes every file byte-exact; a symbolic link on the way is refused (it could point outside the workdir). */
+    private writeFiles;
+    /** Removes the tracked files under the prune directories that the caller no longer lists. */
+    private pruneFiles;
+    /** The absolute path of a repository-relative one — and a last check that it stays inside the workdir. */
+    private inside;
+    /** Refuses a path whose existing parent is a symbolic link. */
+    private assertNoLink;
+    /** `git diff --name-status -z` → added/modified and deleted paths, sorted. */
+    private parseNameStatus;
+    private head;
+    /** The child environment: no prompt, and the token — if any — as an URL-scoped extra header. */
+    private gitEnv;
+    /** Values that must never appear in a log or error text (the token and its header form). */
+    private secrets;
+    /** Runs one git command, logs it, and throws a rich, redacted error on failure (unless `allowFailure`). */
+    private git;
+    private failure;
+    private refusal;
+    /** The generic secret redaction, plus the literal token values of this sync. */
+    private redact;
+}
+//# sourceMappingURL=git-sync.service.d.ts.map

package/build/_modules/git-sync/git-sync.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync.service.d.ts","sourceRoot":"","sources":["../../../src/_modules/git-sync/git-sync.service.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,oBAAoB,EAAgC,gCAAgC,EACtB,8BAA8B,EAC5F,6BAA6B,EAC9B,MAAM,8BAA8B,CAAC;AAWtC;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,iFAAiF;IACjF,OAAO,CAAC,KAAK,CAAuC;IAEpD,wGAAwG;gBAC5F,QAAQ,EAAE,gCAAgC;IAkBtD,+EAA+E;IAC/E,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAcjD;IAEF;;;OAGG;IACG,IAAI,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,6BAA6B,CAAC;YA0B7E,OAAO;IAuDrB,2GAA2G;YAC7F,cAAc;IAkC5B,gHAAgH;YAClG,UAAU;IAUxB,6FAA6F;YAC/E,UAAU;IAsBxB,0GAA0G;IAC1G,OAAO,CAAC,MAAM;IAUd,+DAA+D;YACjD,YAAY;IAc1B,8EAA8E;IAC9E,OAAO,CAAC,eAAe;YAYT,IAAI;IAIlB,gGAAgG;IAChG,OAAO,CAAC,MAAM;IA8Bd,4FAA4F;IAC5F,OAAO,CAAC,OAAO,CAAgB;IAE/B,2GAA2G;YAC7F,GAAG;IAoBjB,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,OAAO;IAUf,gFAAgF;IAChF,OAAO,CAAC,MAAM;CAMf"}

package/build/_modules/git-sync/git-sync.service.js

@@ -0,0 +1,274 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_GitSync_Service = void 0;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const secret_redaction_util_1 = require("../../_collections/secret-redaction.util");
+const git_sync_input_util_1 = require("./git-sync-input.util");
+/** Config applied to EVERY git command: byte-exact content, no prompt, no host credential helper. */
+const BASE_CONFIG = [
+    '-c', 'core.autocrlf=false', '-c', 'core.safecrlf=false', '-c', 'credential.helper=',
+];
+/** One rejected push is retried (the remote moved between fetch and push); more means contention — report it. */
+const MAX_ATTEMPTS = 2;
+/**
+ * BFR-OLDLIGHTSITE-003 — synchronises a caller-built file set into a git repository as ONE commit, pushed.
+ *
+ * @description Per call: clone (first use) or fetch → force-reset the owned workdir to the remote branch → write the
+ *   files byte-exact → remove tracked files the caller no longer lists under its `prune` directories → ONE commit →
+ *   push (fast-forward only: a push is never forced). Nothing changed → no commit (`unchanged`). The remote moved
+ *   between fetch and push → the whole step runs once more on the new head.
+ *
+ *   The token (`<credentialRef>_TOKEN`, FDP Keystore) reaches git ONLY as an environment-scoped `http.extraHeader`
+ *   (`GIT_CONFIG_*`): never in an argument (visible in the process list), never in the URL, never in `.git/config`.
+ *   Every error text is redacted — the token literal included.
+ */
+class DyNTS_GitSync_Service {
+    settings;
+    runner;
+    timeoutMs;
+    /** The calls of this instance run one after another — they share one workdir. */
+    queue = Promise.resolve();
+    /** Validates the settings (a 400 on a configuration error); the token is only read when `sync` runs. */
+    constructor(settings) {
+        const problems = git_sync_input_util_1.DyNTS_GitSyncInput_Util.settingsProblems(settings);
+        if (problems.length) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 400,
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-GITSYNC-CF0`,
+                message: `GitSync settings rejected: ${problems.join('; ')}`,
+                userMessage: 'The repository synchronisation is misconfigured.',
+                additionalContent: { problems: problems },
+            });
+        }
+        this.settings = { ...settings, repoUrl: settings.repoUrl.trim(), workdir: (0, path_1.resolve)(settings.workdir) };
+        this.runner = settings.runner ?? DyNTS_GitSync_Service.defaultRunner;
+        this.timeoutMs = Math.max(1000, settings.timeoutMs ?? 120000);
+    }
+    /** The default runner: the `git` binary, no shell, bounded time and output. */
+    static defaultRunner = (args, options) => (new Promise((done) => {
+        (0, child_process_1.execFile)('git', args, {
+            cwd: options.cwd, env: options.env, timeout: options.timeoutMs, maxBuffer: 64 * 1024 * 1024, windowsHide: true,
+        }, (error, stdout, stderr) => {
+            const code = error ? Reflect.get(error, 'code') : 0;
+            done({
+                exitCode: typeof code === 'number' ? code : error ? -1 : 0,
+                stdout: String(stdout ?? ''),
+                stderr: String(stderr ?? '') || (error ? error.message : ''),
+            });
+        });
+    }));
+    /**
+     * One synchronisation step — see the class description. Concurrent calls on the same instance are queued (one
+     * workdir); ⚠️ two INSTANCES or processes must not share a workdir.
+     */
+    async sync(request) {
+        const run = this.queue.then(() => this.syncNow(request));
+        this.queue = run.catch(() => undefined);
+        try {
+            return await run;
+        }
+        catch (error) {
+            if (error instanceof fsm_dynamo_1.DyFM_Error) {
+                throw error;
+            }
+            // a filesystem failure (permission, disk full, a file where a directory is needed) — rich and redacted
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 500,
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-GITSYNC-FS0`,
+                message: `GitSync failed in ${this.settings.workdir}: `
+                    + this.redact(fsm_dynamo_1.DyFM_Error.getErrorMessage(error)),
+                userMessage: 'The repository synchronisation failed. Please try again later.',
+                error: secret_redaction_util_1.DyNTS_SecretRedaction_Util.redactErrorForLog(error),
+            });
+        }
+    }
+    async syncNow(request) {
+        const plan = git_sync_input_util_1.DyNTS_GitSyncInput_Util.plan(request);
+        const env = this.gitEnv(git_sync_input_util_1.DyNTS_GitSyncInput_Util.resolveCredential(this.settings));
+        const log = [];
+        const started = Date.now();
+        for (let attempt = 1;; attempt++) {
+            await this.prepareWorkdir(env, log);
+            await this.writeFiles(plan.files);
+            const removedFiles = await this.pruneFiles(plan, env, log);
+            const paths = [
+                ...plan.files.map((file) => file.path), ...removedFiles,
+            ];
+            if (paths.length) {
+                await this.git('stage', ['add', '--all', '--', ...paths], env, log);
+            }
+            const changes = this.parseNameStatus((await this.git('diff', ['diff', '--cached', '--no-renames', '--name-status', '-z'], env, log)).stdout);
+            if (!changes.changed.length && !changes.removed.length) {
+                return {
+                    status: 'unchanged', commit: await this.head(env, log), changedFiles: [], removedFiles: [],
+                    attempts: attempt, durationMs: Date.now() - started, log: log,
+                };
+            }
+            await this.git('commit', [
+                '-c', `user.name=${this.settings.author.name}`, '-c', `user.email=${this.settings.author.email}`,
+                'commit', '--quiet', '-m', plan.message,
+            ], env, log);
+            const push = await this.git('push', ['push', '--porcelain', 'origin', `HEAD:refs/heads/${this.settings.branch}`], env, log, true);
+            if (!push.exitCode) {
+                return {
+                    status: 'pushed', commit: await this.head(env, log), changedFiles: changes.changed,
+                    removedFiles: changes.removed, attempts: attempt, durationMs: Date.now() - started, log: log,
+                };
+            }
+            const rejected = /rejected|non-fast-forward|fetch first|stale info/i.test(push.stdout + push.stderr);
+            if (!rejected || attempt >= MAX_ATTEMPTS) {
+                throw this.failure('push', push, log, rejected ? 409 : 502);
+            }
+            fsm_dynamo_1.DyFM_Log.warn(`[DyNTS GitSync] the remote branch ${this.settings.branch} moved during the sync — retrying once`);
+        }
+    }
+    /** Clone on first use; otherwise verify the clone's origin, fetch and force-reset to the remote branch. */
+    async prepareWorkdir(env, log) {
+        const workdir = this.settings.workdir;
+        const entries = (0, fs_1.existsSync)(workdir) ? await fs_1.promises.readdir(workdir) : [];
+        if (!entries.length) {
+            await fs_1.promises.mkdir((0, path_1.dirname)(workdir), { recursive: true });
+            await this.git('clone', [
+                'clone', '--quiet', '--no-tags', '--single-branch', '--branch', this.settings.branch, '--',
+                this.settings.repoUrl, workdir,
+            ], env, log, false, (0, path_1.dirname)(workdir));
+            return;
+        }
+        if (!entries.includes('.git')) {
+            throw this.refusal(`the workdir ${workdir} exists, is not empty and is not a git clone — refusing to touch it`, log);
+        }
+        const origin = (await this.git('origin', ['remote', 'get-url', 'origin'], env, log)).stdout.trim();
+        if (origin.replace(/\/+$/, '') !== this.settings.repoUrl.replace(/\/+$/, '')) {
+            throw this.refusal(`the workdir ${workdir} is a clone of a DIFFERENT repository — refusing to touch it`, log);
+        }
+        const remoteRef = `refs/remotes/origin/${this.settings.branch}`;
+        await this.git('fetch', [
+            'fetch', '--quiet', '--no-tags', 'origin', `+refs/heads/${this.settings.branch}:${remoteRef}`,
+        ], env, log);
+        await this.git('reset', ['checkout', '--quiet', '--force', '-B', this.settings.branch, remoteRef], env, log);
+    }
+    /** Writes every file byte-exact; a symbolic link on the way is refused (it could point outside the workdir). */
+    async writeFiles(files) {
+        for (const file of files) {
+            const target = this.inside(file.path);
+            await this.assertNoLink(file.path);
+            await fs_1.promises.mkdir((0, path_1.dirname)(target), { recursive: true });
+            await fs_1.promises.writeFile(target, file.content, 'utf8');
+        }
+    }
+    /** Removes the tracked files under the prune directories that the caller no longer lists. */
+    async pruneFiles(plan, env, log) {
+        if (!plan.prune.length) {
+            return [];
+        }
+        const wanted = new Set(plan.files.map((file) => file.path));
+        const tracked = (await this.git('list', ['ls-files', '-z', '--', ...plan.prune.map((dir) => `${dir}/`)], env, log)).stdout.split('\0').filter((path) => !!path);
+        const removed = tracked.filter((path) => !wanted.has(path)).sort();
+        for (const path of removed) {
+            await fs_1.promises.rm(this.inside(path), { force: true });
+        }
+        return removed;
+    }
+    /** The absolute path of a repository-relative one — and a last check that it stays inside the workdir. */
+    inside(path) {
+        const target = (0, path_1.join)(this.settings.workdir, ...path.split('/'));
+        if (!target.startsWith(this.settings.workdir + path_1.sep)) {
+            throw this.refusal(`${path} resolves outside the workdir`, []);
+        }
+        return target;
+    }
+    /** Refuses a path whose existing parent is a symbolic link. */
+    async assertNoLink(path) {
+        const segments = path.split('/');
+        for (let depth = 1; depth < segments.length; depth++) {
+            const stat = await fs_1.promises.lstat(this.inside(segments.slice(0, depth).join('/'))).catch(() => null);
+            if (stat?.isSymbolicLink()) {
+                throw this.refusal(`${segments.slice(0, depth).join('/')} is a symbolic link — refusing to write through it`, []);
+            }
+        }
+    }
+    /** `git diff --name-status -z` → added/modified and deleted paths, sorted. */
+    parseNameStatus(output) {
+        const parts = output.split('\0').filter((part) => !!part);
+        const changed = [];
+        const removed = [];
+        for (let index = 0; index + 1 < parts.length; index += 2) {
+            (parts[index] === 'D' ? removed : changed).push(parts[index + 1]);
+        }
+        return { changed: changed.sort(), removed: removed.sort() };
+    }
+    async head(env, log) {
+        return (await this.git('head', ['rev-parse', 'HEAD'], env, log)).stdout.trim();
+    }
+    /** The child environment: no prompt, and the token — if any — as an URL-scoped extra header. */
+    gitEnv(credential) {
+        const env = { ...process.env, GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never' };
+        if (credential.status === 'absent' || credential.status === 'invalid') {
+            const detail = credential.status === 'absent'
+                ? `set ${credential.missingKeys.join(', ')} in the FDP Keystore`
+                : credential.problems.join('; ');
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 503,
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-GITSYNC-CR0`,
+                message: `GitSync credential ${credential.credentialRef} is not usable: ${detail}`,
+                userMessage: 'The repository synchronisation is not configured on this server.',
+                additionalContent: { credential: credential },
+            });
+        }
+        if (credential.status === 'configured') {
+            const token = String((this.settings.env ?? process.env)[credential.tokenKey]).trim();
+            const basic = Buffer.from(`${this.settings.tokenUser ?? 'x-access-token'}:${token}`).toString('base64');
+            env.GIT_CONFIG_COUNT = '1';
+            env.GIT_CONFIG_KEY_0 = `http.${new URL(this.settings.repoUrl).origin}/.extraHeader`;
+            env.GIT_CONFIG_VALUE_0 = `Authorization: Basic ${basic}`;
+            this.secrets = [token, basic];
+        }
+        return env;
+    }
+    /** Values that must never appear in a log or error text (the token and its header form). */
+    secrets = [];
+    /** Runs one git command, logs it, and throws a rich, redacted error on failure (unless `allowFailure`). */
+    async git(step, args, env, log, allowFailure = false, cwd = this.settings.workdir) {
+        const started = Date.now();
+        const result = await this.runner([...BASE_CONFIG, ...args], { cwd: cwd, env: env, timeoutMs: this.timeoutMs });
+        log.push({
+            step: step, command: this.redact(`git ${args.join(' ')}`), exitCode: result.exitCode, ms: Date.now() - started,
+        });
+        if (result.exitCode && !allowFailure) {
+            throw this.failure(step, result, log, 502);
+        }
+        return result;
+    }
+    failure(step, result, log, status) {
+        const output = this.redact(`${result.stderr} ${result.stdout}`.trim()).slice(0, 2000);
+        return new fsm_dynamo_1.DyFM_Error({
+            status: status,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-GITSYNC-${status === 409 ? 'RJ0' : 'GT0'}`,
+            message: `GitSync ${step} failed (exit ${result.exitCode}) for ${this.redact(this.settings.repoUrl)}`
+                + ` ${this.settings.branch}: ${output}`,
+            userMessage: status === 409
+                ? 'The repository changed during the synchronisation. Please try again.'
+                : 'The repository synchronisation failed. Please try again later.',
+            additionalContent: { step: step, exitCode: result.exitCode, log: log },
+        });
+    }
+    refusal(reason, log) {
+        return new fsm_dynamo_1.DyFM_Error({
+            status: 409,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-GITSYNC-WD0`,
+            message: `GitSync refused: ${reason}`,
+            userMessage: 'The repository synchronisation is misconfigured.',
+            additionalContent: { log: log },
+        });
+    }
+    /** The generic secret redaction, plus the literal token values of this sync. */
+    redact(text) {
+        return this.secrets.reduce((current, secret) => (secret ? current.split(secret).join('[redacted]') : current), secret_redaction_util_1.DyNTS_SecretRedaction_Util.redactText(text));
+    }
+}
+exports.DyNTS_GitSync_Service = DyNTS_GitSync_Service;
+//# sourceMappingURL=git-sync.service.js.map