@johnhenry/sitefile 0.0.0-stage → 0.0.0

package/lib/src/resources/wbn-reader.js

@@ -0,0 +1,302 @@
+import { SitefileError } from '../errors.js';
+import { normalizeVirtual } from '../paths.js';
+import { makeFile, Tree } from '../tree.js';
+import { CborError, decodeCbor, readCborHead } from '../cbor.js';
+const MAGIC = [0xf0, 0x9f, 0x8c, 0x90, 0xf0, 0x9f, 0x93, 0xa6];
+/** Magic prefix: array head, bstr(8) head, then the 8 magic bytes. */
+const HEAD_LEN = 10;
+/** The trailing length field: bstr(8) head + 8 bytes. */
+const TAIL_LEN = 9;
+const MAX_SECTION_LENGTHS = 8192;
+function hasMagic(b) {
+    if (b.length < HEAD_LEN || (b[0] !== 0x85 && b[0] !== 0x86) || b[1] !== 0x48)
+        return false;
+    return MAGIC.every((x, i) => b[2 + i] === x);
+}
+export function isWebBundle(bytes) {
+    return hasMagic(bytes);
+}
+export function readWebBundle(bytes, origin, limits, span) {
+    const bad = (why) => new SitefileError('E_ARCHIVE', `${origin}: web bundle: ${why}`, span);
+    try {
+        return read(bytes, origin, limits, span, bad);
+    }
+    catch (e) {
+        if (e instanceof CborError)
+            throw bad(`malformed CBOR: ${e.message}`);
+        throw e;
+    }
+}
+function read(bytes, origin, limits, span, bad) {
+    if (!hasMagic(bytes))
+        throw bad('bad magic bytes');
+    if (bytes.length < HEAD_LEN + 5)
+        throw bad('truncated header');
+    const isB1 = bytes[0] === 0x86;
+    if (bytes[HEAD_LEN] !== 0x44 || bytes[HEAD_LEN + 1] !== 0x62 || bytes[HEAD_LEN + 3] !== 0 || bytes[HEAD_LEN + 4] !== 0) {
+        throw bad('unrecognized version field');
+    }
+    const verDigit = bytes[HEAD_LEN + 2];
+    if (verDigit !== (isB1 ? 0x31 : 0x32)) {
+        throw bad(verDigit === 0x31 || verDigit === 0x32 ? 'header does not match its version' : 'unsupported version (expected b1 or b2)');
+    }
+    const version = isB1 ? 'b1' : 'b2';
+    let pos = HEAD_LEN + 5;
+    let primaryUrl;
+    if (isB1) {
+        const p = decodeCbor(bytes.subarray(pos), { maxItems: 1 });
+        if (typeof p.value !== 'string')
+            throw bad('primary URL is not a text string');
+        primaryUrl = p.value;
+        pos += p.end;
+    }
+    // section-lengths
+    const slHead = readCborHead(bytes, pos);
+    if (slHead.major !== 2 || typeof slHead.arg !== 'number')
+        throw bad('section-lengths is not a byte string');
+    if (slHead.arg >= MAX_SECTION_LENGTHS)
+        throw bad('section-lengths is too long');
+    if (slHead.next + slHead.arg > bytes.length)
+        throw bad('truncated section-lengths');
+    const sl = decodeCbor(bytes.subarray(slHead.next, slHead.next + slHead.arg), { maxItems: MAX_SECTION_LENGTHS });
+    if (!Array.isArray(sl.value) || sl.end !== slHead.arg || sl.value.length % 2 !== 0) {
+        throw bad('malformed section-lengths');
+    }
+    const sections = [];
+    pos = slHead.next + slHead.arg;
+    const secHead = readCborHead(bytes, pos);
+    if (secHead.major !== 4)
+        throw bad('sections is not an array');
+    if (secHead.arg !== sl.value.length / 2)
+        throw bad(`section-lengths declares ${sl.value.length / 2} sections but ${secHead.arg} are present`);
+    let cursor = secHead.next;
+    const seen = new Set();
+    for (let i = 0; i < sl.value.length; i += 2) {
+        const name = sl.value[i];
+        const length = sl.value[i + 1];
+        // CBOR unsigned integers only: a negative length would move the cursor backwards.
+        if (typeof name !== 'string' || typeof length !== 'number' || length < 0)
+            throw bad('malformed section-lengths entry');
+        if (seen.has(name))
+            throw bad(`duplicate section '${name}'`);
+        seen.add(name);
+        sections.push({ name, length, start: cursor });
+        cursor += length;
+        if (cursor > bytes.length - TAIL_LEN)
+            throw bad(`section '${name}' extends past the end of the bundle`);
+    }
+    const last = sections[sections.length - 1];
+    if (!last || last.name !== 'responses')
+        throw bad("the last section must be 'responses'");
+    // trailing length
+    if (cursor + TAIL_LEN !== bytes.length)
+        throw bad('section lengths do not add up to the bundle size');
+    if (bytes[cursor] !== 0x48)
+        throw bad('malformed trailing length field');
+    const declared = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getBigUint64(cursor + 1);
+    if (declared !== BigInt(bytes.length))
+        throw bad(`length field says ${declared} bytes but the bundle is ${bytes.length}`);
+    const section = (name) => {
+        const s = sections.find((x) => x.name === name);
+        return s && bytes.subarray(s.start, s.start + s.length);
+    };
+    const primarySection = section('primary');
+    if (primarySection) {
+        const p = decodeCbor(primarySection, { maxItems: 1 });
+        if (typeof p.value !== 'string' || p.end !== primarySection.length)
+            throw bad("malformed 'primary' section");
+        primaryUrl = p.value;
+    }
+    if (primaryUrl !== undefined) {
+        try {
+            new URL(primaryUrl);
+        }
+        catch {
+            throw bad(`primary URL '${primaryUrl}' is not an absolute URL`);
+        }
+    }
+    const indexSection = section('index');
+    if (!indexSection)
+        throw bad("missing 'index' section");
+    const responses = last;
+    const indexHead = readCborHead(indexSection, 0);
+    if (indexHead.major !== 5)
+        throw bad('index is not a map');
+    if (typeof indexHead.arg !== 'number' || indexHead.arg > limits.maxEntries) {
+        throw new SitefileError('E_ARCHIVE_LIMIT', `${origin}: web bundle has more than ${limits.maxEntries} entries`, span);
+    }
+    const index = decodeCbor(indexSection);
+    if (!(index.value instanceof Map) || index.end !== indexSection.length)
+        throw bad('malformed index section');
+    const parsed = new Map();
+    const entries = [];
+    let total = 0;
+    for (const [url, value] of index.value) {
+        if (typeof url !== 'string')
+            throw bad('index key is not a text string');
+        if (!Array.isArray(value))
+            throw bad(`index value for '${url}' is not an array`);
+        let loc;
+        if (isB1) {
+            const variants = value[0];
+            if (!(variants instanceof Uint8Array))
+                throw bad(`index value for '${url}' has no variants-value`);
+            if (value.length !== 3) {
+                throw bad(value.length % 2 === 1 && value.length > 3
+                    ? `'${url}' has multiple variants, which are not supported`
+                    : `index value for '${url}' has an invalid size`);
+            }
+            loc = value.slice(1);
+        }
+        else {
+            if (value.length !== 2)
+                throw bad(`index value for '${url}' must be [offset, length]`);
+            loc = value;
+        }
+        const [off, len] = loc;
+        // A negative offset or length (CBOR major type 1) would read outside the responses section.
+        if (typeof off !== 'number' || typeof len !== 'number' || off < 0 || len < 0) {
+            throw bad(`index offset/length for '${url}' is not an unsigned integer`);
+        }
+        if (off + len > responses.length)
+            throw bad(`response for '${url}' lies outside the responses section`);
+        const key = `${off}:${len}`;
+        let r = parsed.get(key);
+        if (!r) {
+            r = parseResponse(bytes.subarray(responses.start + off, responses.start + off + len), url, bad);
+            parsed.set(key, r);
+        }
+        total += r.body.byteLength;
+        if (total > limits.maxTotalBytes) {
+            throw new SitefileError('E_ARCHIVE_LIMIT', `${origin}: web bundle expands beyond ${limits.maxTotalBytes} bytes`, span);
+        }
+        entries.push({ url, status: r.status, headers: r.headers, body: r.body });
+    }
+    entries.sort((a, b) => (a.url < b.url ? -1 : a.url > b.url ? 1 : 0));
+    return { version, primaryUrl, entries };
+}
+const asciiOf = (b) => {
+    for (const x of b)
+        if (x > 0x7e || x < 0x20)
+            return undefined;
+    return Buffer.from(b).toString('latin1');
+};
+function parseResponse(b, url, bad) {
+    const r = decodeCbor(b, { maxItems: 16 });
+    if (!Array.isArray(r.value) || r.end !== b.length || r.value.length !== 2)
+        throw bad(`response for '${url}' is not [headers, body]`);
+    const [hdrBytes, body] = r.value;
+    if (!(hdrBytes instanceof Uint8Array) || !(body instanceof Uint8Array))
+        throw bad(`response for '${url}' must hold two byte strings`);
+    const h = decodeCbor(hdrBytes, { maxItems: 100_000 });
+    if (!(h.value instanceof Map) || h.end !== hdrBytes.length)
+        throw bad(`response headers for '${url}' are not a CBOR map`);
+    let status;
+    const headers = [];
+    for (const [k, v] of h.value) {
+        if (!(k instanceof Uint8Array) || !(v instanceof Uint8Array))
+            throw bad(`response headers for '${url}' must map byte strings to byte strings`);
+        const name = asciiOf(k);
+        const value = asciiOf(v);
+        if (name === undefined || value === undefined)
+            throw bad(`non-ASCII response header for '${url}'`);
+        if (name !== name.toLowerCase())
+            throw bad(`response header '${name}' for '${url}' is not lower-case`);
+        if (name.startsWith(':')) {
+            if (name !== ':status')
+                throw bad(`unexpected pseudo-header '${name}' for '${url}'`);
+            if (!/^\d{3}$/.test(value))
+                throw bad(`invalid :status '${value}' for '${url}'`);
+            status = Number(value);
+        }
+        else {
+            headers.push([name, value]);
+        }
+    }
+    if (status === undefined)
+        throw bad(`response for '${url}' has no :status`);
+    return { status, headers: Object.fromEntries(headers), body };
+}
+// --------------------------------------------------------------- to a Tree
+/**
+ * Turn a bundle into a Tree. Only status-200 entries become files. When all
+ * such URLs share one origin the artifact path is the URL path; otherwise each
+ * path is prefixed with `/<host[:port]>`. A path ending in `/` maps to
+ * `<path>index.html`; segments are percent-decoded.
+ */
+export function webBundleToTree(bundle, origin, span) {
+    const unsafe = (url, why) => new SitefileError('E_ARCHIVE_UNSAFE', `${origin}: unsafe web bundle URL '${url.replace(/\0/g, '\\0')}': ${why}`, span);
+    const items = [];
+    for (const entry of bundle.entries) {
+        if (entry.status !== 200)
+            continue;
+        const m = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)([^?#]*)(\?[^#]*)?(#.*)?$/.exec(entry.url);
+        if (!m)
+            throw unsafe(entry.url, 'not an absolute http(s) URL');
+        const scheme = m[1].toLowerCase();
+        if (scheme !== 'http' && scheme !== 'https')
+            throw unsafe(entry.url, `scheme '${scheme}:' is not allowed`);
+        if (m[5] !== undefined)
+            throw unsafe(entry.url, 'URL has a fragment');
+        if (m[2].includes('@'))
+            throw unsafe(entry.url, 'URL has credentials');
+        let u;
+        try {
+            u = new URL(`${scheme}://${m[2]}/`);
+        }
+        catch {
+            throw unsafe(entry.url, 'invalid host');
+        }
+        const rawPath = m[3] === '' ? '/' : m[3];
+        if (rawPath.includes('\\'))
+            throw unsafe(entry.url, 'backslash in path');
+        if (!rawPath.startsWith('/'))
+            throw unsafe(entry.url, 'invalid path');
+        const segs = rawPath.slice(1).split('/');
+        const trailing = segs[segs.length - 1] === '';
+        if (trailing)
+            segs.pop();
+        const decoded = [];
+        for (const s of segs) {
+            let d;
+            try {
+                d = decodeURIComponent(s);
+            }
+            catch {
+                throw unsafe(entry.url, 'invalid percent-encoding in path');
+            }
+            if (d === '')
+                throw unsafe(entry.url, 'empty path segment');
+            if (d === '.' || d === '..')
+                throw unsafe(entry.url, `'${d}' path segment`);
+            if (d.includes('\0'))
+                throw unsafe(entry.url, 'NUL byte in path');
+            if (d.includes('\\'))
+                throw unsafe(entry.url, 'backslash in path');
+            if (d.includes('/'))
+                throw unsafe(entry.url, 'encoded slash in path');
+            decoded.push(d);
+        }
+        if (trailing || decoded.length === 0)
+            decoded.push('index.html');
+        items.push({ entry, origin: `${scheme}://${u.host}`, host: u.host, path: '/' + decoded.join('/'), query: m[4] !== undefined });
+    }
+    const multi = new Set(items.map((i) => i.origin)).size > 1;
+    const files = new Map();
+    for (const it of items) {
+        const path = normalizeVirtual((multi ? `/${it.host}` : '') + it.path, span, 'web bundle URL path').path;
+        const prev = files.get(path);
+        if (prev && prev.url !== it.entry.url && (prev.query || it.query)) {
+            throw unsafe(it.entry.url, `its query string makes it collide with '${prev.url}' at '${path}'`);
+        }
+        if (prev) {
+            if (prev.node.digest !== makeFile(it.entry.body, '').digest) {
+                throw new SitefileError('E_CONFLICT', `${origin}: '${prev.url}' and '${it.entry.url}' both map to '${path}' with different content`, span);
+            }
+            continue;
+        }
+        files.set(path, { node: makeFile(it.entry.body, `${origin}:${it.entry.url}`), url: it.entry.url, query: it.query });
+    }
+    return Tree.fromFiles([...files].map(([p, f]) => [p, f.node]));
+}
+//# sourceMappingURL=wbn-reader.js.map

package/lib/src/schema.d.ts

@@ -0,0 +1,25 @@
+import { type SourceSpan } from './errors.js';
+export type SchemaType = 'string' | 'number' | 'boolean' | 'date' | 'list';
+type ItemType = Exclude<SchemaType, 'list'>;
+type EnumValue = string | number | boolean;
+export interface SchemaRule {
+    readonly key: string;
+    readonly type?: SchemaType;
+    readonly items?: ItemType;
+    readonly enum?: readonly EnumValue[];
+}
+/** A compiled schema; `label` names its file in messages. */
+export interface Schema {
+    readonly label: string;
+    readonly required: readonly string[];
+    readonly properties: readonly SchemaRule[];
+}
+/** Compile a parsed schema file. Errors are E_SCHEMA at `span` (the SCHEMA clause), prefixed with `what`. */
+export declare function compileSchema(value: unknown, label: string, what: string, span: SourceSpan): Schema;
+/**
+ * Check an import's value against a schema: each element of a list, or a single document. Every element must be
+ * an object (E_TYPE otherwise). The first mismatch fails with E_SCHEMA at `span`, naming the document (its `path`,
+ * or `#n` for the n-th element), the key, what was expected and what was found.
+ */
+export declare function checkSchema(value: unknown, schema: Schema, what: string, csv: boolean, span: SourceSpan): void;
+export {};

package/lib/src/schema.js

@@ -0,0 +1,169 @@
+// Frontmatter and data schemas: `IMPORT posts FROM ./posts AS markdown SCHEMA ./post.schema.yaml`.
+//
+// A schema is a small, deterministic subset of JSON Schema, written as a YAML or JSON mapping:
+//
+//   required: [title, date]          # keys every document must have (null counts as missing)
+//   properties:                      # key -> rule; keys not listed are not checked
+//     title: string                  # a type name ...
+//     tags: { type: list, items: string }
+//     status: { enum: [draft, published] }
+//
+// Types: string, number, boolean, date (YYYY-MM-DD or an RFC 3339 date-time, as FEED reads it) and list
+// (`items` gives the type of its elements). `enum` lists the allowed strings, numbers or booleans (for a list,
+// the allowed elements). In a CSV import every cell is a string, so `number` also accepts a numeric string and
+// `boolean` the strings `true` and `false`, enum entries match their text, and an empty cell counts as missing. docs/LANGUAGE.md has the rules.
+import { SitefileError } from './errors.js';
+import { parseFeedDate } from './site.js';
+const TYPES = ['string', 'number', 'boolean', 'date', 'list'];
+const ITEM_TYPES = ['string', 'number', 'boolean', 'date'];
+const NUMERIC = /^-?\d+(\.\d+)?([eE][+-]?\d+)?$/;
+/** What a value of each type looks like, for messages. */
+const EXPECTED = {
+    string: 'a string',
+    number: 'a number',
+    boolean: 'true or false',
+    date: 'a date (YYYY-MM-DD or an RFC 3339 date-time)',
+    list: 'a list',
+};
+const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+/** Compile a parsed schema file. Errors are E_SCHEMA at `span` (the SCHEMA clause), prefixed with `what`. */
+export function compileSchema(value, label, what, span) {
+    const fail = (m) => {
+        throw new SitefileError('E_SCHEMA', `${what}: schema '${label}' ${m}`, span);
+    };
+    if (!isObject(value))
+        fail('must be a mapping (with required and/or properties)');
+    const root = value;
+    for (const k of Object.keys(root)) {
+        if (k !== 'required' && k !== 'properties')
+            fail(`has an unknown key '${k}' (expected required or properties)`);
+    }
+    const required = [];
+    if (root['required'] !== undefined) {
+        const r = root['required'];
+        if (!Array.isArray(r) || !r.every((k) => typeof k === 'string' && k !== ''))
+            fail("needs 'required' to be a list of key names");
+        for (const k of r)
+            if (!required.includes(k))
+                required.push(k);
+    }
+    const properties = [];
+    if (root['properties'] !== undefined) {
+        const p = root['properties'];
+        if (!isObject(p))
+            fail("needs 'properties' to be a mapping of key names to rules");
+        for (const [key, rule] of Object.entries(p)) {
+            const at = `property '${key}':`;
+            const typeName = (t, allowed, kind) => {
+                if (typeof t !== 'string' || !allowed.includes(t)) {
+                    const shown = typeof t === 'string' ? ` '${t}'` : '';
+                    fail(`${at} unknown ${kind}${shown} (expected ${allowed.slice(0, -1).join(', ')} or ${allowed[allowed.length - 1]})`);
+                }
+                return t;
+            };
+            if (typeof rule === 'string') {
+                properties.push({ key, type: typeName(rule, TYPES, 'type') });
+                continue;
+            }
+            if (!isObject(rule))
+                fail(`${at} expected a type name or a mapping with type, items or enum`);
+            const r = rule;
+            for (const k of Object.keys(r)) {
+                if (k !== 'type' && k !== 'items' && k !== 'enum')
+                    fail(`${at} unknown key '${k}' (expected type, items or enum)`);
+            }
+            const type = r['type'] !== undefined ? typeName(r['type'], TYPES, 'type') : undefined;
+            let items;
+            if (r['items'] !== undefined) {
+                if (type !== 'list')
+                    fail(`${at} items needs type list`);
+                items = typeName(r['items'], ITEM_TYPES, 'items type');
+            }
+            let values;
+            if (r['enum'] !== undefined) {
+                const e = r['enum'];
+                if (!Array.isArray(e) || e.length === 0 || !e.every((x) => typeof x === 'string' || typeof x === 'number' || typeof x === 'boolean')) {
+                    fail(`${at} enum must be a non-empty list of strings, numbers or booleans`);
+                }
+                values = e;
+            }
+            properties.push({ key, ...(type ? { type } : {}), ...(items ? { items } : {}), ...(values ? { enum: values } : {}) });
+        }
+    }
+    return { label, required, properties };
+}
+/** How a value is shown in a mismatch message. */
+function describe(v) {
+    if (v === null)
+        return 'null';
+    if (typeof v === 'string')
+        return `string '${v}'`;
+    if (typeof v === 'number')
+        return `number ${String(v)}`;
+    if (typeof v === 'boolean')
+        return `boolean ${String(v)}`;
+    if (Array.isArray(v))
+        return 'a list';
+    return 'an object';
+}
+function hasType(v, t, csv) {
+    switch (t) {
+        case 'string':
+            return typeof v === 'string';
+        case 'number':
+            return typeof v === 'number' || (csv && typeof v === 'string' && NUMERIC.test(v.trim()));
+        case 'boolean':
+            return typeof v === 'boolean' || (csv && (v === 'true' || v === 'false'));
+        case 'date':
+            return typeof v === 'string' && parseFeedDate(v) !== undefined;
+        case 'list':
+            return Array.isArray(v);
+    }
+}
+function inEnum(v, values, csv) {
+    return values.some((e) => e === v || (csv && typeof v === 'string' && v === String(e)));
+}
+/**
+ * Check an import's value against a schema: each element of a list, or a single document. Every element must be
+ * an object (E_TYPE otherwise). The first mismatch fails with E_SCHEMA at `span`, naming the document (its `path`,
+ * or `#n` for the n-th element), the key, what was expected and what was found.
+ */
+export function checkSchema(value, schema, what, csv, span) {
+    const docs = Array.isArray(value) ? value : [value];
+    docs.forEach((doc, i) => {
+        if (!isObject(doc)) {
+            throw new SitefileError('E_TYPE', `${what}: SCHEMA checks documents (objects), but element ${i + 1} is ${describe(doc)}`, span);
+        }
+        const name = typeof doc['path'] === 'string' ? doc['path'] : `#${i + 1}`;
+        const fail = (m) => {
+            throw new SitefileError('E_SCHEMA', `${what}: document '${name}' ${m}`, span);
+        };
+        // A CSV cell is always there: an empty one counts as missing.
+        const missing = (v) => v === undefined || v === null || (csv && v === '');
+        for (const key of schema.required) {
+            if (missing(Object.hasOwn(doc, key) ? doc[key] : undefined))
+                fail(`has no '${key}' (required by schema '${schema.label}')`);
+        }
+        for (const rule of schema.properties) {
+            const v = Object.hasOwn(doc, rule.key) ? doc[rule.key] : undefined;
+            if (missing(v))
+                continue;
+            const enumText = (values) => values.map((e) => String(e)).join(', ');
+            if (rule.type !== undefined && !hasType(v, rule.type, csv))
+                fail(`has '${rule.key}' ${describe(v)}; it should be ${EXPECTED[rule.type]}`);
+            if (rule.type === 'list') {
+                v.forEach((item, j) => {
+                    if (rule.items !== undefined && !hasType(item, rule.items, csv)) {
+                        fail(`has '${rule.key}' item ${j + 1} ${describe(item)}; it should be ${EXPECTED[rule.items]}`);
+                    }
+                    if (rule.enum !== undefined && !inEnum(item, rule.enum, csv))
+                        fail(`has '${rule.key}' item ${j + 1} ${describe(item)}; it should be one of ${enumText(rule.enum)}`);
+                });
+            }
+            else if (rule.enum !== undefined && !inEnum(v, rule.enum, csv)) {
+                fail(`has '${rule.key}' ${describe(v)}; it should be one of ${enumText(rule.enum)}`);
+            }
+        }
+    });
+}
+//# sourceMappingURL=schema.js.map

package/lib/src/secrets.d.ts

@@ -0,0 +1,21 @@
+export type Secrets = ReadonlyMap<string, string>;
+/**
+ * Parse `--secret` flags: `id=<id>,env=<VAR>` (an environment variable) or `id=<id>,src=<file>` (a
+ * file, relative to the working directory; one trailing newline is dropped). Values are checked to
+ * be usable as an HTTP header value. Messages never include a value.
+ */
+export declare function loadSecrets(flags: readonly string[], env?: NodeJS.ProcessEnv): Promise<Map<string, string>>;
+/** Replace every occurrence of a secret value (longest first) with `***`. */
+export declare function redactSecrets(text: string, secrets: Secrets | undefined): string;
+/** A SitefileError whose message has the secrets redacted (the same error when nothing changes). */
+export declare function redactError(e: unknown, secrets: Secrets | undefined): unknown;
+/** The request headers of an import's SECRET clauses; a secret that was not given is E_SECRET. */
+export declare function secretHeaders(spec: {
+    readonly name: string;
+    readonly secrets?: readonly {
+        readonly id: string;
+        readonly header: string;
+        readonly bearer: boolean;
+    }[];
+    readonly span: import('./errors.js').SourceSpan;
+}, secrets: Secrets | undefined): Record<string, string> | undefined;

package/lib/src/secrets.js

@@ -0,0 +1,103 @@
+import { readFile } from 'node:fs/promises';
+import { SitefileError, isSitefileError } from './errors.js';
+/**
+ * Build secrets (issue #85), modelled on Docker's `--secret id=…,env=…|src=…`: values that remote
+ * IMPORTs send as HTTP request headers (`IMPORT … SECRET <id> AS HEADER <Name>` / `AS BEARER`).
+ *
+ * A secret value lives only in memory: it is sent to the IMPORT URL's own origin (never after a
+ * redirect to another one) and never becomes part of the output, a cache or memo key, Sitefile.lock,
+ * a vendor manifest, provenance, a --profile trace, a warning or an error message. As a last line of
+ * defence, warnings and errors of a build that has secrets are passed through {@link redactSecrets}.
+ */
+const ID_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Visible ASCII, space and tab: what every HTTP client sends unchanged in a header value. */
+const HEADER_VALUE_RE = /^[\t\x20-\x7e]+$/;
+function usage(message) {
+    return new SitefileError('E_USAGE', message);
+}
+/**
+ * Parse `--secret` flags: `id=<id>,env=<VAR>` (an environment variable) or `id=<id>,src=<file>` (a
+ * file, relative to the working directory; one trailing newline is dropped). Values are checked to
+ * be usable as an HTTP header value. Messages never include a value.
+ */
+export async function loadSecrets(flags, env = process.env) {
+    const out = new Map();
+    for (const flag of flags) {
+        const fields = new Map();
+        for (const part of flag.split(',')) {
+            const eq = part.indexOf('=');
+            const key = eq < 0 ? part : part.slice(0, eq);
+            if (eq < 0 || (key !== 'id' && key !== 'env' && key !== 'src')) {
+                throw usage('--secret expects id=<id>,env=<VAR> or id=<id>,src=<file>'); // never echo the flag: it might be the secret itself
+            }
+            if (fields.has(key))
+                throw usage(`--secret: '${key}' given twice`);
+            fields.set(key, part.slice(eq + 1));
+        }
+        const id = fields.get('id');
+        if (id === undefined || !ID_RE.test(id))
+            throw usage(`--secret needs id=<id> (letters, digits and _, not starting with a digit)`);
+        if (out.has(id))
+            throw usage(`--secret id=${id} given twice`);
+        const name = fields.get('env');
+        const src = fields.get('src');
+        if ((name === undefined) === (src === undefined))
+            throw usage(`--secret id=${id}: give exactly one of env=<VAR> or src=<file>`);
+        let value;
+        if (name !== undefined) {
+            const v = env[name];
+            if (v === undefined)
+                throw new SitefileError('E_SECRET', `--secret id=${id}: environment variable ${name} is not set`);
+            value = v;
+        }
+        else {
+            let bytes;
+            try {
+                bytes = await readFile(src);
+            }
+            catch (e) {
+                throw new SitefileError('E_SECRET', `--secret id=${id}: cannot read '${src}'`, undefined, { cause: isSitefileError(e) ? e : undefined });
+            }
+            value = bytes.toString('latin1').replace(/\r?\n$/, '');
+        }
+        if (value === '')
+            throw new SitefileError('E_SECRET', `--secret id=${id} is empty`);
+        if (!HEADER_VALUE_RE.test(value)) {
+            throw new SitefileError('E_SECRET', `--secret id=${id} cannot be sent in an HTTP header (only printable ASCII, spaces and tabs)`);
+        }
+        out.set(id, value);
+    }
+    return out;
+}
+/** Replace every occurrence of a secret value (longest first) with `***`. */
+export function redactSecrets(text, secrets) {
+    if (!secrets || secrets.size === 0)
+        return text;
+    let out = text;
+    for (const v of [...secrets.values()].sort((a, b) => b.length - a.length))
+        if (v.length > 0)
+            out = out.split(v).join('***');
+    return out;
+}
+/** A SitefileError whose message has the secrets redacted (the same error when nothing changes). */
+export function redactError(e, secrets) {
+    if (!isSitefileError(e) || !secrets || secrets.size === 0)
+        return e;
+    const detail = redactSecrets(e.detail, secrets);
+    return detail === e.detail ? e : new SitefileError(e.code, detail, e.span);
+}
+/** The request headers of an import's SECRET clauses; a secret that was not given is E_SECRET. */
+export function secretHeaders(spec, secrets) {
+    if (!spec.secrets?.length)
+        return undefined;
+    const headers = {};
+    for (const s of spec.secrets) {
+        const v = secrets?.get(s.id);
+        if (v === undefined) {
+            throw new SitefileError('E_SECRET', `IMPORT ${spec.name}: secret '${s.id}' was not given; pass --secret id=${s.id},env=<VAR> or --secret id=${s.id},src=<file>`, spec.span);
+        }
+        headers[s.header.toLowerCase()] = s.bearer ? `Bearer ${v}` : v;
+    }
+    return headers;
+}
+//# sourceMappingURL=secrets.js.map

package/lib/src/serve-rules.d.ts

@@ -0,0 +1,29 @@
+/** A `_redirects` rule `serve` understands. */
+export interface ServeRedirect {
+    /** Decoded path without a trailing slash (`/` for the root); for a splat rule, the prefix before `/*` (`''` for `/*`). */
+    readonly from: string;
+    readonly splat: boolean;
+    readonly to: string;
+    readonly status: number;
+    /** `301!`: applies even when a file exists at the path. */
+    readonly force: boolean;
+}
+export interface ServeHeaders {
+    readonly pattern: string;
+    /** Lowercase names. */
+    readonly headers: ReadonlyArray<readonly [string, string]>;
+}
+/**
+ * Parse `_redirects`: `from to [status[!]]` per line, `#` comments. Supported: exact paths and a
+ * trailing `/*` with `:splat` in the target; statuses 301, 302, 303, 307, 308 (redirect), 200
+ * (rewrite) and 404. Other lines (placeholders, conditions, query matching) are ignored.
+ */
+export declare function parseRedirectRules(text: string): ServeRedirect[];
+/** Parse `_headers`: a path pattern line (`*` matches anything), then indented `Name: value` lines. */
+export declare function parseHeaderRules(text: string): ServeHeaders[];
+/** Glob match where `*` matches any run of characters (including `/`). */
+export declare function globMatch(pattern: string, s: string): boolean;
+/** Every matching block's headers; a name set by several blocks gets its values joined with `, `. */
+export declare function headersFor(rules: readonly ServeHeaders[], path: string): Record<string, string>;
+/** The remainder a rule matches for `path` (`''` for the prefix itself), or undefined. */
+export declare function matchRedirect(r: ServeRedirect, path: string): string | undefined;