@magland/mochi 0.3.1 → 0.4.0

package/dist/onetime.js

@@ -0,0 +1,112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOneTimeStore = createOneTimeStore;
+exports.mintHandoffCode = mintHandoffCode;
+exports.normalizeHandoffCode = normalizeHandoffCode;
+const crypto = __importStar(require("crypto"));
+/** How many entries a store holds before new ones are refused a slot: the
+ * mints are all authenticated or rate-limited, so this is a backstop, not a
+ * quota anyone should meet. When it is hit, the oldest entry is dropped,
+ * which turns an attempted flood into self-inflicted expiry. */
+const MAX_ENTRIES = 5000;
+function createOneTimeStore(mint = mintOpaqueId) {
+    const entries = new Map();
+    const sweep = (now) => {
+        for (const [id, e] of entries) {
+            if (e.expiresAt <= now)
+                entries.delete(id);
+        }
+    };
+    const live = (id) => {
+        const e = entries.get(id);
+        if (!e)
+            return null;
+        if (e.expiresAt <= Date.now()) {
+            entries.delete(id);
+            return null;
+        }
+        return e;
+    };
+    return {
+        put(value, ttlMs) {
+            const now = Date.now();
+            sweep(now);
+            if (entries.size >= MAX_ENTRIES) {
+                const oldest = entries.keys().next();
+                if (!oldest.done)
+                    entries.delete(oldest.value);
+            }
+            const id = mint();
+            entries.set(id, { value, expiresAt: now + ttlMs });
+            return id;
+        },
+        take(id) {
+            const e = live(id);
+            if (!e)
+                return null;
+            entries.delete(id);
+            return e.value;
+        },
+        peek(id) {
+            return live(id)?.value ?? null;
+        },
+    };
+}
+function mintOpaqueId() {
+    return crypto.randomBytes(24).toString('base64url');
+}
+// The alphabet a person retypes across the room: no 0/O, 1/I/L, or lowercase.
+// Eight characters carry just under 40 bits, which with a five-minute life
+// and the sign-in rate limit is far beyond guessing.
+const CODE_ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+/** A code like MQ4V-7XKP, for typing on another device. */
+function mintHandoffCode() {
+    const chars = [];
+    for (let i = 0; i < 8; i++) {
+        chars.push(CODE_ALPHABET[crypto.randomInt(CODE_ALPHABET.length)]);
+        if (i === 3)
+            chars.push('-');
+    }
+    return chars.join('');
+}
+/** The reading of a typed code: case, spaces, and the dash are the display's
+ * business and are dropped; the characters themselves must match, which the
+ * alphabet makes unambiguous by never containing 0/O or 1/I/L. The dash is
+ * re-inserted so the normalized form is the minted form. */
+function normalizeHandoffCode(typed) {
+    const s = typed.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    return s.length === 8 ? `${s.slice(0, 4)}-${s.slice(4)}` : s;
+}

package/dist/ops.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NewBranchError = exports.MAX_UPLOAD_SIZE = exports.MAX_EDIT_SIZE = exports.OpError = void 0;
+exports.NewBranchError = exports.MAX_DESCRIPTION_LENGTH = exports.MAX_UPLOAD_SIZE = exports.MAX_EDIT_SIZE = exports.OpError = void 0;
 exports.opErrorStatus = opErrorStatus;
 exports.createCollection = createCollection;
 exports.createRepo = createRepo;
@@ -43,14 +43,17 @@ exports.commitFileChange = commitFileChange;
 exports.previewMerge = previewMerge;
 exports.mergeBranch = mergeBranch;
 exports.createBranch = createBranch;
+exports.collectRepo = collectRepo;
 exports.deleteBranch = deleteBranch;
 exports.createTag = createTag;
 exports.deleteTag = deleteTag;
 exports.setDefaultBranch = setDefaultBranch;
+exports.setUpstream = setUpstream;
 exports.setDescription = setDescription;
 exports.containedIn = containedIn;
 exports.renameRepo = renameRepo;
 exports.renameCollection = renameCollection;
+exports.deleteCollection = deleteCollection;
 exports.deleteRepo = deleteRepo;
 exports.writeFile = writeFile;
 exports.createRepoWithReadme = createRepoWithReadme;
@@ -61,8 +64,11 @@ const path = __importStar(require("path"));
 const atomic_1 = require("./atomic");
 const git_1 = require("./git");
 const perms_1 = require("./perms");
+const sitesettings_1 = require("./sitesettings");
 const vault_1 = require("./vault");
 const pointer_1 = require("./pointer");
+const source_1 = require("./source");
+const domains_1 = require("./domains");
 const redirects_1 = require("./redirects");
 const layout_1 = require("./layout");
 const scan_1 = require("./scan");
@@ -134,24 +140,66 @@ function tmpFile(prefix) {
 function createCollection(root, name) {
     if (!(0, scan_1.isValidName)(name) || (0, scan_1.isDotName)(name))
         throw new OpError('invalid collection name');
+    checkNewName('collection', name);
     const dir = (0, layout_1.collectionDir)(root, name);
     if (fs.existsSync(dir))
         throw new OpError(`collection ${name} already exists`, 'exists');
+    checkCollectionCase(root, name);
     fs.mkdirSync(dir, { recursive: true });
     fs.mkdirSync(path.join(dir, layout_1.REPOS_DIR));
     return dir;
 }
+/**
+ * The checks every route a collection or repository name comes into being
+ * through shares, beyond the character rules isValidName applies. Only asked
+ * at creation and rename: reading stays permissive, so a vault that already
+ * holds such a name keeps serving it.
+ *
+ * The length cap keeps the on-disk form (`<name>.git`, `<name>.issues`) well
+ * clear of the 255-byte filename limit, which a longer name would otherwise
+ * hit inside the filesystem and surface as a bare failure. A trailing dot is
+ * refused because `name..git` cannot exist on Windows and reads like a typo
+ * everywhere else.
+ */
+function checkNewName(kind, name) {
+    if (name.length > scan_1.MAX_NAME_LENGTH) {
+        throw new OpError(`a ${kind} name may be at most ${scan_1.MAX_NAME_LENGTH} characters (this one is ${name.length})`);
+    }
+    if (name.endsWith('.'))
+        throw new OpError(`a ${kind} name may not end with a dot`);
+}
 /**
  * Refuse a name that would place a new repository on top of the directories
  * another repository keeps beside it. Creation is the only place this is
  * asked: a repository that already carries such a name goes on working.
  */
 function checkNewRepoName(name) {
+    checkNewName('repository', name);
     const suffix = (0, scan_1.reservedRepoSuffix)(name);
     if (suffix) {
         throw new OpError(`a repository may not be named to end in ${suffix}, which is reserved for the directories a repository keeps beside it`);
     }
 }
+/**
+ * Refuse a collection or repository name that matches an existing one apart
+ * from letter case. Two names telling apart only by case are confusing side by
+ * side in every listing, and a vault holding both would not survive a copy to
+ * a case-insensitive filesystem (macOS, Windows) or backup target.
+ * `allowSelf`, on a rename, is the name being moved away from, so a rename
+ * that only changes case is not refused as a collision with itself.
+ */
+function checkCollectionCase(root, name, allowSelf) {
+    const clash = (0, scan_1.collectionCaseClash)(root, name);
+    if (clash && clash !== allowSelf) {
+        throw new OpError(`collection ${clash} already exists; names may not differ only in letter case`, 'exists');
+    }
+}
+function checkRepoCase(root, collection, name, allowSelf) {
+    const clash = (0, scan_1.repoCaseClash)(root, collection, name);
+    if (clash && clash !== allowSelf) {
+        throw new OpError(`${collection}/${clash} already exists; names may not differ only in letter case`, 'exists');
+    }
+}
 /**
  * Refuse a dot-prefixed collection. A repository's collection is created on
  * the way when it does not exist, here and in fork and move alike, so the
@@ -167,11 +215,25 @@ async function createRepo(root, collection, name, opts = {}) {
     if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(name))
         throw new OpError('invalid collection or repository name');
     checkNewCollectionName(collection);
+    checkNewName('collection', collection);
     checkNewRepoName(name);
+    if ((0, scan_1.findRepo)(root, collection, name))
+        throw new OpError(`${collection}/${name} already exists`, 'exists');
+    // The case check on the collection only matters when this create would bring
+    // the collection into being: a collection that already exists under exactly
+    // this name is simply being added to, whatever else the vault holds.
+    if (!fs.existsSync((0, layout_1.collectionDir)(root, collection)))
+        checkCollectionCase(root, collection);
+    checkRepoCase(root, collection, name);
     fs.mkdirSync((0, layout_1.reposDir)(root, collection), { recursive: true });
     const dir = (0, layout_1.repoPath)(root, collection, `${name}.git`);
     await (0, git_1.execGit)(root, ['init', '--bare', '--initial-branch=main', dir]);
-    await (0, git_1.execGit)(dir, ['config', 'receive.denyNonFastForwards', 'true']);
+    // Deletes are refused on push and force pushes are not, which is GitHub's
+    // arrangement for a branch nothing protects: rewriting a branch is how a
+    // history is corrected, and what it abandons is collected by the sweep in
+    // src/maintenance.ts, while deleting one is done through the web or the API,
+    // where it is confirmed. A vault upgraded from before this ran with
+    // receive.denyNonFastForwards set; migratePushPolicy unsets it.
     await (0, git_1.execGit)(dir, ['config', 'receive.denyDeletes', 'true']);
     await (0, git_1.execGit)(dir, ['config', 'receive.maxInputSize', String(2 * 1024 * 1024 * 1024)]);
     // Written before the repository is announced anywhere, so a repository asked
@@ -201,6 +263,7 @@ async function forkRepo(root, collection, name, toCollection, toName) {
         throw new OpError('invalid collection or repository name');
     }
     checkNewCollectionName(toCollection);
+    checkNewName('collection', toCollection);
     checkNewRepoName(toName);
     if (toCollection === collection && toName === name) {
         throw new OpError('a repository cannot be forked onto itself');
@@ -208,12 +271,15 @@ async function forkRepo(root, collection, name, toCollection, toName) {
     if ((0, scan_1.findRepo)(root, toCollection, toName)) {
         throw new OpError(`${toCollection}/${toName} already exists`, 'exists');
     }
+    if (!fs.existsSync((0, layout_1.collectionDir)(root, toCollection)))
+        checkCollectionCase(root, toCollection);
+    checkRepoCase(root, toCollection, toName);
     fs.mkdirSync((0, layout_1.reposDir)(root, toCollection), { recursive: true });
     const dir = (0, layout_1.repoPath)(root, toCollection, `${toName}.git`);
     await (0, git_1.execGit)(root, ['clone', '--bare', source.dir, dir]);
     await (0, git_1.execGit)(dir, ['remote', 'remove', 'origin']).catch(() => undefined);
     await (0, git_1.execGit)(dir, ['config', 'mochi.forkedFrom', `${collection}/${name}`]);
-    await (0, git_1.execGit)(dir, ['config', 'receive.denyNonFastForwards', 'true']);
+    // As createRepo: deletes refused on push, force pushes allowed.
     await (0, git_1.execGit)(dir, ['config', 'receive.denyDeletes', 'true']);
     await (0, git_1.execGit)(dir, ['config', 'receive.maxInputSize', String(2 * 1024 * 1024 * 1024)]);
     const description = fs.existsSync(path.join(source.dir, 'description'))
@@ -269,10 +335,16 @@ async function commitFiles(repoDir, args) {
     const removals = args.removals ?? [];
     if (!(0, git_1.isValidRefName)(branch) || branch.startsWith('-'))
         throw new OpError('invalid branch name');
+    // A first commit is also the branch coming into being, so the name takes
+    // the same rules explicit branch creation applies.
+    if (expectedHead === null)
+        checkNewRefName('branch', branch);
     if (files.length === 0 && removals.length === 0)
         throw new OpError('no files to commit');
     for (const file of files) {
-        if (!(0, git_1.isValidRepoPath)(file.path) || file.path === '')
+        // The stricter write-side rule: paths only being removed stay on the
+        // permissive one, so whatever the repository already holds can go.
+        if (!(0, git_1.isValidNewRepoPath)(file.path) || file.path === '')
             throw new OpError(`invalid file path: ${file.path}`);
     }
     for (const target of removals) {
@@ -348,12 +420,19 @@ async function commitFileChange(repoDir, args) {
     const { branch, filePath, message, author, expectedHead, action } = args;
     if (!(0, git_1.isValidRefName)(branch) || branch.startsWith('-'))
         throw new OpError('invalid branch name');
-    if (!(0, git_1.isValidRepoPath)(filePath) || filePath === '')
+    // A first commit is also the branch coming into being; see commitFiles.
+    if (expectedHead === null)
+        checkNewRefName('branch', branch);
+    // A path being created takes the stricter write-side rule; a path that is
+    // only being edited in place or deleted stays on the permissive one, so a
+    // file the repository already holds under an awkward name can still go.
+    const pathCheck = action.kind === 'create' ? git_1.isValidNewRepoPath : git_1.isValidRepoPath;
+    if (!pathCheck(filePath) || filePath === '')
         throw new OpError('invalid file path');
     if (expectedHead !== null && !(0, git_1.isValidSha)(expectedHead))
         throw new OpError('invalid expected commit');
     const toPath = action.kind === 'edit' && action.toPath && action.toPath !== filePath ? action.toPath : null;
-    if (toPath !== null && !(0, git_1.isValidRepoPath)(toPath))
+    if (toPath !== null && !(0, git_1.isValidNewRepoPath)(toPath))
         throw new OpError('invalid file path');
     if (expectedHead !== null) {
         if (action.kind === 'create') {
@@ -531,9 +610,60 @@ async function moveBranch(repoDir, branch, to, from) {
         throw new OpError(`branch ${branch} has moved since this page was loaded`, 'conflict');
     }
 }
+/**
+ * Refuse a name no new branch or tag may carry, saying which rule it broke.
+ * The rules themselves live in isValidNewRefName (src/git.ts); this spells
+ * each refusal out, because "invalid branch name" helps nobody whose name was
+ * refused for being a pseudo-ref or for carrying a pasted refs/ prefix.
+ */
+function checkNewRefName(kind, name) {
+    if ((0, git_1.isValidNewRefName)(name))
+        return;
+    if (name === 'HEAD' || /^[A-Z_]+_HEAD$/.test(name)) {
+        throw new OpError(`${name} is reserved by git; a ${kind} of that name would be ambiguous on every clone`);
+    }
+    if (name === 'refs' || name.startsWith('refs/')) {
+        throw new OpError(`name the ${kind} without the refs/ prefix`);
+    }
+    if (name.length > 200) {
+        throw new OpError(`a ${kind} name may be at most 200 characters (this one is ${name.length})`);
+    }
+    throw new OpError(`invalid ${kind} name`);
+}
+/**
+ * Why creating `refs/<space>/<name>` failed, as an OpError a person can act
+ * on. update-ref fails the same way whether the ref exists or its name
+ * collides with the file/directory shape of another ref (creating `feat` when
+ * `feat/sub` exists, or the reverse), so the two are told apart here rather
+ * than both reported as "already exists".
+ */
+async function refCreateError(repoDir, kind, space, name, fallback) {
+    if (await refTip(repoDir, `${space}/${name}`)) {
+        return new OpError(`${kind} ${name} already exists`, 'exists');
+    }
+    try {
+        const under = (await (0, git_1.execGit)(repoDir, ['for-each-ref', '--count=1', '--format=%(refname)', `${space}/${name}/`]))
+            .toString('utf8')
+            .trim();
+        if (under !== '') {
+            const other = under.slice(space.length + 1);
+            return new OpError(`${kind} ${name} conflicts with existing ${kind} ${other}; a ${kind} cannot also name a prefix of another`, 'conflict');
+        }
+        const parts = name.split('/');
+        for (let i = 1; i < parts.length; i++) {
+            const prefix = parts.slice(0, i).join('/');
+            if (await refTip(repoDir, `${space}/${prefix}`)) {
+                return new OpError(`${kind} ${name} conflicts with existing ${kind} ${prefix}; a ${kind} cannot also name a prefix of another`, 'conflict');
+            }
+        }
+    }
+    catch {
+        // Diagnosis is best-effort; the fallback below still names the failure.
+    }
+    return new OpError(`could not create ${kind} ${name}: ${fallback instanceof Error ? fallback.message : fallback}`);
+}
 async function createBranch(repoDir, name, fromRef) {
-    if (!(0, git_1.isValidRefName)(name) || name.startsWith('-'))
-        throw new OpError('invalid branch name');
+    checkNewRefName('branch', name);
     if (!(0, git_1.isValidRefName)(fromRef) || fromRef.startsWith('-'))
         throw new OpError('invalid source ref');
     await (0, git_1.execGit)(repoDir, ['check-ref-format', `refs/heads/${name}`]);
@@ -543,10 +673,65 @@ async function createBranch(repoDir, name, fromRef) {
     try {
         await (0, git_1.execGit)(repoDir, ['update-ref', `refs/heads/${name}`, sha, '']);
     }
-    catch {
-        throw new OpError(`branch ${name} already exists`, 'exists');
+    catch (e) {
+        throw await refCreateError(repoDir, 'branch', 'refs/heads', name, e);
     }
 }
+async function objectStats(repoDir) {
+    const out = (await (0, git_1.execGit)(repoDir, ['count-objects', '-v'])).toString('utf8');
+    const field = (name) => {
+        const line = out.split('\n').find((l) => l.startsWith(`${name}: `));
+        const value = line ? Number(line.slice(name.length + 2).trim()) : 0;
+        return Number.isFinite(value) ? value : 0;
+    };
+    return {
+        objects: field('count') + field('in-pack'),
+        kilobytes: field('size') + field('size-pack'),
+    };
+}
+/**
+ * How recent an unreachable object has to be to survive an on-demand
+ * collection.
+ *
+ * Not `now`, deliberately. A push uploads its objects before it moves the
+ * branch that will make them reachable, so during those seconds its objects are
+ * unreachable in exactly the way abandoned ones are, and a collection sparing
+ * nothing could delete a push in flight. Five minutes is far longer than that
+ * window and short enough that anything a person is asking to be rid of, which
+ * is by definition something already pushed and then rewritten away, is gone.
+ * The periodic sweep in src/maintenance.ts is far more generous, because it runs
+ * unattended and nobody is watching it.
+ */
+const ON_DEMAND_PRUNE = '5.minutes.ago';
+/** A collection this slow is one the caller should not be waiting on. */
+const GC_TIMEOUT_MS = 10 * 60 * 1000;
+/**
+ * Collect one repository now: drop every object no ref can reach, and repack
+ * what is left.
+ *
+ * This is the answer to "I pushed something I should not have, rewrote it out of
+ * the history, and want it gone", which the periodic sweep cannot be: that one
+ * spares anything unreachable but recent, so it does not promise promptness.
+ * Reflogs are expired first, since a vault configured to keep them would
+ * otherwise hold a reference to exactly the commits being disowned.
+ */
+async function collectRepo(repoDir) {
+    const before = await objectStats(repoDir);
+    await (0, git_1.execGit)(repoDir, ['reflog', 'expire', '--expire=now', '--expire-unreachable=now', '--all']).catch(() => undefined);
+    try {
+        await (0, git_1.execGit)(repoDir, ['gc', '--quiet', `--prune=${ON_DEMAND_PRUNE}`], { timeoutMs: GC_TIMEOUT_MS });
+    }
+    catch (e) {
+        // The commonest failure is another gc holding the repository's gc.pid lock,
+        // which is a conflict rather than a fault: the work is already happening.
+        const message = e instanceof Error ? e.message : String(e);
+        if (/gc is already running|gc\.pid/i.test(message)) {
+            throw new OpError('a collection is already running on this repository', 'conflict');
+        }
+        throw new OpError(`could not collect the repository: ${message}`);
+    }
+    return { before, after: await objectStats(repoDir) };
+}
 async function deleteBranch(repoDir, name) {
     if (!(0, git_1.isValidRefName)(name) || name.startsWith('-'))
         throw new OpError('invalid branch name');
@@ -556,8 +741,7 @@ async function deleteBranch(repoDir, name) {
     await (0, git_1.execGit)(repoDir, ['update-ref', '-d', `refs/heads/${name}`]);
 }
 async function createTag(repoDir, name, atRef) {
-    if (!(0, git_1.isValidRefName)(name) || name.startsWith('-'))
-        throw new OpError('invalid tag name');
+    checkNewRefName('tag', name);
     if (!(0, git_1.isValidRefName)(atRef) || atRef.startsWith('-'))
         throw new OpError('invalid target ref');
     await (0, git_1.execGit)(repoDir, ['check-ref-format', `refs/tags/${name}`]);
@@ -567,8 +751,8 @@ async function createTag(repoDir, name, atRef) {
     try {
         await (0, git_1.execGit)(repoDir, ['update-ref', `refs/tags/${name}`, sha, '']);
     }
-    catch {
-        throw new OpError(`tag ${name} already exists`, 'exists');
+    catch (e) {
+        throw await refCreateError(repoDir, 'tag', 'refs/tags', name, e);
     }
 }
 async function deleteTag(repoDir, name) {
@@ -584,8 +768,32 @@ async function setDefaultBranch(repoDir, branch) {
         throw new OpError(`branch ${branch} not found`, 'notfound');
     await (0, git_1.execGit)(repoDir, ['symbolic-ref', 'HEAD', `refs/heads/${branch}`]);
 }
+/**
+ * Record (or clear, with '') the URL outside this vault the repository was
+ * forked from, as `mochi.upstream`. Only the two URL shapes `mochi fork`
+ * clones from are accepted, so what upstreamOf later reads back always parses.
+ */
+async function setUpstream(repoDir, url) {
+    if (url === '') {
+        await (0, git_1.execGit)(repoDir, ['config', '--unset', 'mochi.upstream']).catch(() => undefined);
+        return;
+    }
+    if (!(0, source_1.parseUpstream)(url))
+        throw new OpError('the upstream must be an https or ssh git URL');
+    await (0, git_1.execGit)(repoDir, ['config', 'mochi.upstream', url]);
+}
+/**
+ * The longest description a repository may carry. Descriptions are rendered on
+ * the listing pages, so an unbounded one is a one-field way to swell every
+ * page that names the repository; a few hundred characters is room for a
+ * sentence or two, which is what the field is for.
+ */
+exports.MAX_DESCRIPTION_LENGTH = 500;
 function setDescription(repoDir, text) {
     const line = text.replace(/\s+/g, ' ').trim();
+    if (line.length > exports.MAX_DESCRIPTION_LENGTH) {
+        throw new OpError(`the description may be at most ${exports.MAX_DESCRIPTION_LENGTH} characters (this one is ${line.length}); longer prose belongs in the README`);
+    }
     (0, atomic_1.writeFileAtomic)(path.join(repoDir, 'description'), line === '' ? '' : line + '\n');
 }
 function containedIn(rootReal, target) {
@@ -624,12 +832,19 @@ async function renameRepo(root, collection, name, toCollection, toName, ctx = {}
         throw new OpError('invalid collection or repository name');
     }
     checkNewCollectionName(toCollection);
+    checkNewName('collection', toCollection);
     checkNewRepoName(toName);
     if (toCollection === collection && toName === name)
         throw new OpError('that is already its name', 'nochange');
     if ((0, scan_1.findRepo)(root, toCollection, toName)) {
         throw new OpError(`${toCollection}/${toName} already exists`, 'exists');
     }
+    if (!fs.existsSync((0, layout_1.collectionDir)(root, toCollection)))
+        checkCollectionCase(root, toCollection);
+    // A rename that only changes the name's case is the repository colliding
+    // with itself, which is allowed; anything else that matches apart from case
+    // is refused.
+    checkRepoCase(root, toCollection, toName, toCollection === collection ? name : undefined);
     const rootReal = fs.realpathSync(root);
     if (!containedIn(rootReal, repo.dir)) {
         throw new OpError('repository directory is outside the vault; refusing to move it');
@@ -673,6 +888,10 @@ async function renameRepo(root, collection, name, toCollection, toName, ctx = {}
     // and a move that then failed would point at a repository that is not there.
     // See src/redirects.ts for what the redirect does and does not survive.
     (0, redirects_1.recordRepoRename)(root, collection, name, toCollection, toName);
+    // A custom domain maps to the repository by name, so the mapping is
+    // re-pointed with the rename; the domain itself does not change, which is
+    // the point of having one.
+    (0, domains_1.moveRepoDomains)(root, collection, name, toCollection, toName);
 }
 /**
  * Rename a collection.
@@ -694,6 +913,7 @@ async function renameCollection(root, name, toName, ctx = {}) {
     if (!(0, scan_1.isValidName)(name) || !(0, scan_1.isValidName)(toName) || (0, scan_1.isDotName)(toName)) {
         throw new OpError('invalid collection name');
     }
+    checkNewName('collection', toName);
     const dir = (0, layout_1.collectionDir)(root, name);
     let isDir = false;
     try {
@@ -709,6 +929,9 @@ async function renameCollection(root, name, toName, ctx = {}) {
     const dest = (0, layout_1.collectionDir)(root, toName);
     if (fs.existsSync(dest))
         throw new OpError(`collection ${toName} already exists`, 'exists');
+    // A rename that only changes the case of this collection's own name is
+    // allowed; a case-variant of any other collection is refused.
+    checkCollectionCase(root, toName, name);
     const rootReal = fs.realpathSync(root);
     if (!containedIn(rootReal, dir)) {
         throw new OpError('collection directory is outside the vault; refusing to move it');
@@ -744,6 +967,54 @@ async function renameCollection(root, name, toName, ctx = {}) {
     // - the collection page and every repository in it - is redirected to the new
     // one until something else is created under that name.
     (0, redirects_1.recordCollectionRename)(root, name, toName);
+    // And every custom domain into the collection follows it, as the repository
+    // hook above does for one.
+    (0, domains_1.moveCollectionDomains)(root, name, toName);
+}
+/**
+ * Delete a collection, and only an empty one: deletion is for a name that is
+ * no longer wanted, not a way to remove many repositories at once, so a
+ * collection holding any repository - or anything a repository keeps beside
+ * it - is refused rather than emptied. The collection's own metadata
+ * (collection.json, the owners file, and site.json, its site alias) does not
+ * count against emptiness: it describes the collection and goes with it, as a
+ * repository's issues go with the repository. A file this layer does not
+ * recognize is refused rather than deleted, since it is not the collection's
+ * to lose.
+ */
+function deleteCollection(root, name) {
+    if (!(0, scan_1.isValidName)(name))
+        throw new OpError('invalid collection name');
+    const dir = (0, layout_1.collectionDir)(root, name);
+    let isDir = false;
+    try {
+        isDir = fs.statSync(dir).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (!isDir)
+        throw new OpError(`collection ${name} not found`, 'notfound');
+    const rootReal = fs.realpathSync(root);
+    if (!containedIn(rootReal, dir)) {
+        throw new OpError('collection directory is outside the vault; refusing to delete it');
+    }
+    const repos = (0, layout_1.reposDir)(root, name);
+    const inRepos = fs.existsSync(repos) ? fs.readdirSync(repos) : [];
+    if (inRepos.length > 0)
+        throw new OpError(`collection ${name} is not empty`, 'conflict');
+    const own = fs
+        .readdirSync(dir)
+        .filter((n) => n !== layout_1.REPOS_DIR && n !== perms_1.COLLECTION_FILE && n !== sitesettings_1.COLLECTION_SITE_FILE);
+    if (own.length > 0) {
+        throw new OpError(`collection ${name} holds ${own[0]}, which this server did not put there; refusing to delete it`, 'conflict');
+    }
+    fs.rmSync(dir, { recursive: true });
+    // Any redirect that led here goes with it. A collection created later under
+    // this name would otherwise inherit the traffic a former name of this one
+    // still sends.
+    (0, redirects_1.forgetCollectionRedirects)(root, name);
+    (0, domains_1.dropCollectionDomains)(root, name);
 }
 /**
  * Delete a repository and everything it accumulated: the bare repository, its
@@ -787,8 +1058,9 @@ async function deleteRepo(root, collection, name, ctx = {}) {
     // And any redirect that led here. A redirect pointing at a repository that
     // no longer exists is inert, but one left pointing at a name that is later
     // re-created would send traffic meant for the deleted repository to whatever
-    // took its place.
+    // took its place. A custom domain is dropped on exactly the same reasoning.
     (0, redirects_1.forgetRepoRedirects)(root, collection, name);
+    (0, domains_1.dropRepoDomains)(root, collection, name);
 }
 /**
  * A write that failed before it began, because the branch it was to go on could
@@ -851,8 +1123,13 @@ async function writeFile(repoDir, request) {
  * The caller fires the push event, since it holds the CI engine.
  */
 async function createRepoWithReadme(root, collection, name, opts) {
+    const description = (opts.description ?? '').replace(/\s+/g, ' ').trim();
+    // Checked before the repository exists, so a refused description does not
+    // leave a created repository behind the error page.
+    if (description.length > exports.MAX_DESCRIPTION_LENGTH) {
+        throw new OpError(`the description may be at most ${exports.MAX_DESCRIPTION_LENGTH} characters (this one is ${description.length}); longer prose belongs in the README`);
+    }
     const repo = await createRepo(root, collection, name, { private: opts.private });
-    const description = (opts.description ?? '').trim();
     if (description)
         setDescription(repo.dir, description);
     if (!opts.readme)