@magland/mochi 0.3.1 → 0.4.0

package/dist/session.js

@@ -35,17 +35,19 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSecret = getSecret;
 exports.setSessionCookie = setSessionCookie;
+exports.renewSession = renewSession;
 exports.clearSessionCookie = clearSessionCookie;
 exports.getViewer = getViewer;
 exports.viewerIsAdmin = viewerIsAdmin;
 exports.checkCsrf = checkCsrf;
+exports.originOk = originOk;
 exports.csrfMatches = csrfMatches;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const config_1 = require("./config");
+const domains_1 = require("./domains");
 const filecache_1 = require("./filecache");
-const siteshost_1 = require("./siteshost");
+const naming_1 = require("./naming");
 const perms_1 = require("./perms");
 const vault_1 = require("./vault");
 // Stateless signed-cookie sessions on top of the token model. The payload is
@@ -54,14 +56,15 @@ const vault_1 = require("./vault");
 // request, so deleting a user's tokens cuts them off, and rotating .secret
 // invalidates every session at once.
 //
-// A session is bound to the single token it was minted from, by recording that
-// token's SHA-256 hash (the same value vault.json stores, so no new secret is
-// put in the cookie, and the hash is useless as a credential). Resolving a
-// session looks that token up in live vault.json, so deleting one token ends
-// the sessions it started and leaves the user's other sessions alone. The
-// token record found this way is the real one, which is why the session carries
-// no copy of the token's scope: the role checks in src/perms.ts read it from
-// the vault.
+// A session is bound to the single credential it was minted from, by
+// recording that token's SHA-256 hash (the same value vault.json stores, so
+// no new secret is put in the cookie, and the hash is useless as a
+// credential) or, for a passkey sign-in, the passkey's binding string (see
+// authForBinding in src/vault.ts). Resolving a session looks that credential
+// up in live vault.json, so deleting one token or passkey ends the sessions
+// it started and leaves the user's other sessions alone. The token record
+// found this way is the real one, which is why the session carries no copy of
+// the token's scope: the role checks in src/perms.ts read it from the vault.
 // Cookies are not scoped by origin, so any document on any host under a shared
 // parent domain can set a cookie named mochi_session with
 // Domain=<parent>, which the browser then also sends here. With several vaults
@@ -72,9 +75,14 @@ const vault_1 = require("./vault");
 // The prefix also requires Secure and Path=/, so the name is conditional on
 // exactly when the prefix is legal: setSessionCookie already sets path '/' and
 // sets secure from req.protocol, and a plain-http vault keeps the bare name.
-const HOST_COOKIE_NAME = '__Host-mochi_session';
-const COOKIE_NAME = 'mochi_session';
-const cookieName = (req) => (req.protocol === 'https' ? HOST_COOKIE_NAME : COOKIE_NAME);
+// Read through src/naming.ts at call time, so an application that renamed the
+// cookie (dango, say) gets its own name from the same modules; for mochiforge
+// these spell mochi_session and __Host-mochi_session as they always did.
+const hostCookieName = () => `__Host-${naming_1.naming.cookieName}`;
+const cookieName = (req) => (req.protocol === 'https' ? hostCookieName() : naming_1.naming.cookieName);
+// Effectively an idle limit rather than a hard one: renewSession below
+// re-issues a cookie seen in the second half of its life, so only a session
+// unused for this long actually expires.
 const SESSION_MS = 30 * 24 * 60 * 60 * 1000;
 /** Write a fresh signing key where one is missing or unusable. */
 function mintSecret(file) {
@@ -110,23 +118,16 @@ function sign(root, data) {
     return b64url(crypto.createHmac('sha256', getSecret(root)).update(data).digest());
 }
 /**
- * Whether this request arrived on a hostname that serves sites. No session is
- * resolved and none is minted there. The sites middleware never asks for a
- * viewer, so this is defence in depth: it makes structurally true what would
- * otherwise be true only by inspection.
+ * Whether this request arrived on a hostname that serves sites, the sites host
+ * and every custom domain alike. No session is resolved and none is minted
+ * there. The sites middleware never asks for a viewer, so this is defence in
+ * depth: it makes structurally true what would otherwise be true only by
+ * inspection.
  */
 function onSitesHost(req, root) {
-    return (0, siteshost_1.isUnderSitesHost)((0, config_1.loadConfig)(root).sites.host, req.hostname);
+    return (0, domains_1.isSiteRequest)(root, req.hostname);
 }
-function setSessionCookie(req, res, root, auth) {
-    if (onSitesHost(req, root))
-        return;
-    const payload = {
-        u: auth.username,
-        exp: Date.now() + SESSION_MS,
-        csrf: crypto.randomBytes(16).toString('hex'),
-        t: auth.token.hash,
-    };
+function writeSessionCookie(req, res, root, payload) {
     const body = b64url(Buffer.from(JSON.stringify(payload), 'utf8'));
     res.cookie(cookieName(req), `${body}.${sign(root, body)}`, {
         httpOnly: true,
@@ -136,11 +137,49 @@ function setSessionCookie(req, res, root, auth) {
         path: '/',
     });
 }
+function setSessionCookie(req, res, root, auth) {
+    if (onSitesHost(req, root))
+        return;
+    writeSessionCookie(req, res, root, {
+        u: auth.username,
+        exp: Date.now() + SESSION_MS,
+        csrf: crypto.randomBytes(16).toString('hex'),
+        t: auth.token.hash,
+    });
+}
+/**
+ * A session in use is kept alive. A request arriving in the second half of the
+ * cookie's life gets a fresh cookie carrying the same identity, credential
+ * binding, and csrf value (so a form already open in another tab still
+ * submits), with the expiry pushed out to a full SESSION_MS again. An account
+ * visited more often than every SESSION_MS therefore never sees a sign-out,
+ * while a session left idle still dies on schedule. The renewal re-resolves
+ * the credential against live vault.json first: a session whose token or
+ * passkey has been revoked is not given a fresh cookie on its way out.
+ */
+function renewSession(req, res, root) {
+    if (onSitesHost(req, root))
+        return;
+    const session = readSession(req, root);
+    if (!session)
+        return;
+    if (session.exp - Date.now() > SESSION_MS / 2)
+        return;
+    const state = (0, vault_1.loadVault)(root);
+    if (state.status !== 'ok')
+        return;
+    if (!(0, vault_1.authForBinding)(state.vault, session.u, session.t))
+        return;
+    writeSessionCookie(req, res, root, { ...session, exp: Date.now() + SESSION_MS });
+}
 // Both names, since a session minted before the prefix existed, or over http
-// on a vault that has since gained TLS, is still a session to clear.
+// on a vault that has since gained TLS, is still a session to clear. The
+// prefix rules apply to the deletion Set-Cookie too: without Secure the
+// browser discards it and the session survives, so sign-out would silently do
+// nothing on an https vault.
 function clearSessionCookie(res) {
-    res.clearCookie(HOST_COOKIE_NAME, { path: '/' });
-    res.clearCookie(COOKIE_NAME, { path: '/' });
+    res.clearCookie(hostCookieName(), { path: '/', secure: true });
+    res.clearCookie(naming_1.naming.cookieName, { path: '/' });
 }
 function parseCookies(header) {
     const out = {};
@@ -160,11 +199,14 @@ function parseCookies(header) {
     return out;
 }
 function readSession(req, root) {
-    // The prefixed name first, then the bare one, so a session minted before this
-    // existed survives. A sibling subdomain can still set the bare name, which is
-    // why the prefixed one wins when both arrive.
+    // Only the name this request would have been given a cookie under. On an
+    // https vault that is the prefixed one, and the bare name is not read at
+    // all: a sibling subdomain can set the bare name with a Domain attribute,
+    // and reading it here would let such a page hand a visitor a session of the
+    // attacker's. A session minted over https before the prefix existed is
+    // therefore a sign-out, once, which is the smaller cost.
     const cookies = parseCookies(req.headers.cookie);
-    const raw = cookies[HOST_COOKIE_NAME] ?? cookies[COOKIE_NAME];
+    const raw = cookies[cookieName(req)];
     if (!raw)
         return null;
     const dot = raw.lastIndexOf('.');
@@ -208,13 +250,13 @@ function getViewer(req, root) {
     const state = (0, vault_1.loadVault)(root);
     if (state.status !== 'ok')
         return null;
-    const user = state.vault.users[session.u];
-    if (!user)
-        return null;
-    const token = user.tokens.find((t) => t.hash === session.t);
-    if (!token)
+    // `t` is the token hash the session was minted from, or a passkey binding;
+    // either way it resolves against live vault.json, so revoking the token or
+    // removing the passkey ends the session on the next request.
+    const auth = (0, vault_1.authForBinding)(state.vault, session.u, session.t);
+    if (!auth)
         return null;
-    return { auth: { username: session.u, user, token }, csrf: session.csrf };
+    return { auth, csrf: session.csrf };
 }
 function viewerIsAdmin(viewer) {
     return viewer !== null && (0, perms_1.isSiteAdmin)(viewer.auth);

package/dist/site.js

@@ -36,14 +36,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.setSiteHeaders = setSiteHeaders;
 exports.serveSite = serveSite;
 exports.siteHostUrl = siteHostUrl;
+exports.siteRedirectUrl = siteRedirectUrl;
 exports.registerSiteHost = registerSiteHost;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("./config");
+const domains_1 = require("./domains");
 const ops_1 = require("./ops");
+const perms_1 = require("./perms");
 const redirects_1 = require("./redirects");
 const render_1 = require("./render");
 const scan_1 = require("./scan");
+const sitesettings_1 = require("./sitesettings");
 const siteshost_1 = require("./siteshost");
 const web_1 = require("./web");
 /**
@@ -96,15 +100,35 @@ function sendSite404(res, mode, message = 'Not found') {
  * wildcard, and on a site's own hostname the repository is the origin root, so
  * it is the whole of req.path.
  */
-function serveSite(root, collection, repo, req, res, mode) {
+function serveSite(root, collection, repo, req, res, mode, auth = null) {
     const found = (0, scan_1.findRepo)(root, collection, repo);
+    const notFound = `Repository ${collection}/${repo} not found`;
     if (!found) {
-        sendSite404(res, mode, `Repository ${collection}/${repo} not found`);
+        sendSite404(res, mode, notFound);
+        return;
+    }
+    // A private repository's published site is served to anyone, as GitHub
+    // Pages serves one (docs/vault.md says so and why). What is not given away
+    // is the repository's existence: a visitor who could not read it gets, for
+    // a site that is switched off or has no directory, the same sentence an
+    // absent repository gets, rather than one that names the repository and
+    // tells them how its admin could publish. On a sites hostname no session
+    // is resolved, so every visitor there is that visitor.
+    const hidden = (0, perms_1.repoIsPrivate)(found.dir) && !(0, perms_1.canReadRepo)(root, auth, found);
+    // The switch, checked before the directory: a site that is not enabled is
+    // not served whatever is on disk, and the files stay where they are for the
+    // day it is enabled again.
+    if (!(0, sitesettings_1.siteSettings)(found.dir).enabled) {
+        sendSite404(res, mode, hidden
+            ? notFound
+            : `${found.collection}/${found.name} does not publish a site. A repository admin can enable one in its settings.`);
         return;
     }
     const dir = (0, scan_1.siteDir)(root, found.collection, found.name);
     if (!dir) {
-        sendSite404(res, mode, `No site for ${found.collection}/${found.name}. Create a ${found.name}.site directory next to the repository, with an index.html at its root.`);
+        sendSite404(res, mode, hidden
+            ? notFound
+            : `No site for ${found.collection}/${found.name}. Create a ${found.name}.site directory next to the repository, with an index.html at its root.`);
         return;
     }
     // The real path of the site directory, which every path we serve has to
@@ -193,14 +217,50 @@ function minimalPage(status, title, body) {
 </head><body><h1>${status} ${title}</h1><p>${body}</p></body></html>
 `;
 }
+/**
+ * The one hostname a repository's site answers on, or null when it is served
+ * on the forge host. Precedence is custom domain, then custom label on the
+ * sites host, then the derived <repo>--<alias> label; every other hostname
+ * that reaches the same site 301s here, so published links converge on one
+ * origin the way they do for a rename.
+ */
+function canonicalSiteHostname(root, collection, repo, repoDir) {
+    const domain = (0, domains_1.repoDomain)(root, collection, repo);
+    if (domain)
+        return domain;
+    const sitesHost = (0, config_1.loadConfig)(root).sites.host;
+    if (!sitesHost)
+        return null;
+    const label = (0, sitesettings_1.siteSettings)(repoDir).label;
+    if (label)
+        return `${label}.${sitesHost}`;
+    return (0, sitesettings_1.siteHostFor)(root, sitesHost, collection, repo);
+}
 /**
  * The site's own URL for a repository, when it has an origin of its own, or null
  * when it is served on the forge host. The scheme mirrors the request, so a
- * local http vault redirects to http and stays usable.
+ * local http vault redirects to http and stays usable. This is where the site
+ * would be served, whether or not it is enabled; what gates links and
+ * redirects is the enabled flag, which the callers that need it check.
  */
 function siteHostUrl(root, req, collection, repo) {
-    const sitesHost = (0, config_1.loadConfig)(root).sites.host;
-    const host = (0, siteshost_1.siteHostFor)(sitesHost, collection, repo);
+    const found = (0, scan_1.findRepo)(root, collection, repo);
+    const host = found
+        ? canonicalSiteHostname(root, found.collection, found.name, found.dir)
+        : (0, sitesettings_1.siteHostFor)(root, (0, config_1.loadConfig)(root).sites.host, collection, repo);
+    return host ? `${req.protocol}://${host}` : null;
+}
+/**
+ * The origin the forge-path site routes should redirect to, or null to serve
+ * in place. Unlike siteHostUrl it answers only for a site that is enabled: a
+ * disabled site's forge path should 404 where it is asked rather than send the
+ * visitor to another origin to be told the same thing.
+ */
+function siteRedirectUrl(root, req, collection, repo) {
+    const found = (0, scan_1.findRepo)(root, collection, repo);
+    if (!found || !(0, sitesettings_1.siteSettings)(found.dir).enabled)
+        return null;
+    const host = canonicalSiteHostname(root, found.collection, found.name, found.dir);
     return host ? `${req.protocol}://${host}` : null;
 }
 /**
@@ -217,40 +277,63 @@ function siteHostUrl(root, req, collection, repo) {
  */
 function registerSiteHost(app, root) {
     app.use((req, res, next) => {
+        // A custom domain is checked first because it is the one site hostname
+        // that is not under the sites host: one stat-cached read of domains.json,
+        // the same price the config read below already pays.
+        const viaDomain = (0, domains_1.domainRepoFor)(root, req.hostname);
         const sitesHost = (0, config_1.loadConfig)(root).sites.host;
-        if (!sitesHost)
+        if (!viaDomain && !(sitesHost && (0, siteshost_1.isUnderSitesHost)(sitesHost, req.hostname)))
             return next();
-        if (!(0, siteshost_1.isUnderSitesHost)(sitesHost, req.hostname))
-            return next();
-        // Sites are files. Nothing on this hostname writes anything, so nothing
+        // Sites are files. Nothing on these hostnames writes anything, so nothing
         // needs a method that would.
         if (req.method !== 'GET' && req.method !== 'HEAD') {
             res.status(405).set('Allow', 'GET, HEAD').type('html').send(minimalPage(405, 'Method not allowed', 'This hostname serves static files, so it answers only GET and HEAD.'));
             return;
         }
-        const named = (0, siteshost_1.parseSiteHost)(sitesHost, req.hostname);
+        // What the hostname names: the mapped repository for a custom domain, and
+        // otherwise whatever the name under the sites host resolves to, which is
+        // findRepoBySiteHostname's business rather than this handler's.
+        const named = viaDomain ?? (0, sitesettings_1.findRepoBySiteHostname)(root, sitesHost, req.hostname);
         if (!named) {
-            // A request to the bare sites host, or to a deeper name under it, gets a
-            // minimal 404 rather than falling through to the forge, so the forge is
-            // reachable only on its own hostname.
+            // A request to the bare sites host, to a deeper name under it, or to a
+            // label nothing answers to gets a minimal 404 rather than falling
+            // through to the forge, so the forge is reachable only on its own
+            // hostname.
             setSiteHeaders(res, 'sandbox');
             res.status(404).type('html').send(minimalPage(404, 'No site here', 'This hostname does not name a repository site in this vault.'));
             return;
         }
-        // A site has a hostname of its own, built from the repository's name, so a
-        // rename moves the site to a different hostname and every published link
-        // to it stops resolving to anything. The redirect the forge host does for
-        // paths is done here for hostnames, on the same terms: only when no
-        // repository answers to the name in this one.
-        if (!(0, scan_1.findRepo)(root, named.collection, named.repo)) {
+        const redirect = (host) => {
+            res
+                .status(301)
+                .set('Cache-Control', 'no-store')
+                .set('Location', `${req.protocol}://${host}${req.originalUrl}`)
+                .end();
+        };
+        const found = (0, scan_1.findRepo)(root, named.collection, named.repo);
+        if (!found) {
+            // A site has a hostname of its own, built from the repository's name, so
+            // a rename moves the site to a different hostname and every published
+            // link to it stops resolving to anything. The redirect the forge host
+            // does for paths is done here for hostnames, on the same terms: only
+            // when no repository answers to the name in this one.
             const moved = (0, redirects_1.resolveRepoRedirect)(root, named.collection, named.repo);
-            const host = moved && (0, siteshost_1.siteHostFor)(sitesHost, moved.collection, moved.repo);
-            if (host) {
-                res
-                    .status(301)
-                    .set('Cache-Control', 'no-store')
-                    .set('Location', `${req.protocol}://${host}${req.originalUrl}`)
-                    .end();
+            const movedRepo = moved && (0, scan_1.findRepo)(root, moved.collection, moved.repo);
+            const host = movedRepo && canonicalSiteHostname(root, movedRepo.collection, movedRepo.name, movedRepo.dir);
+            if (host && host !== (0, siteshost_1.normalizeHostname)(req.hostname)) {
+                redirect(host);
+                return;
+            }
+        }
+        else {
+            // A repository with a custom domain or a custom label still answers on
+            // its other hostnames, by sending the visitor to the one it prefers, the
+            // way a renamed repository's old hostname does. no-store for the same
+            // reason: which hostname is canonical is a setting, and a cached 301
+            // would outlive changing it.
+            const canonical = canonicalSiteHostname(root, found.collection, found.name, found.dir);
+            if (canonical && canonical !== (0, siteshost_1.normalizeHostname)(req.hostname)) {
+                redirect(canonical);
                 return;
             }
         }

package/dist/sitepublish.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SitePublishError = void 0;
+exports.describeSiteSource = describeSiteSource;
+exports.siteFollowsRef = siteFollowsRef;
+exports.publishSiteFromRepository = publishSiteFromRepository;
+exports.publishSiteAfterPush = publishSiteAfterPush;
+exports.publishSiteForSettings = publishSiteForSettings;
+exports.siteDirExists = siteDirExists;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const artifacts_1 = require("./ci/artifacts");
+const git_1 = require("./git");
+const layout_1 = require("./layout");
+const scan_1 = require("./scan");
+const sitesettings_1 = require("./sitesettings");
+// Publishing a site from the repository itself: the third site source, beside
+// files copied into the directory and a workflow's deploy step. With it, the
+// site directory is a checkout the server maintains of the default branch (or
+// a directory within it), rewritten on every push that moves that branch and
+// whenever the settings that decide it change. It is what GitHub Pages calls
+// deploying from a branch, and it is the mode for a repository whose site is
+// plain files that need no build: the push is the deploy, and nothing else has
+// to run anywhere.
+//
+// The tree is taken with `git archive`, so a `.gitattributes` line such as
+// `secret.txt export-ignore` keeps a file out of the site, and it goes through
+// the same extraction as a workflow artifact does (installSiteFromTar): into a
+// scratch directory, symlinks that would escape it removed, then one rename.
+// A failed publish leaves the previous site in place.
+class SitePublishError extends Error {
+}
+exports.SitePublishError = SitePublishError;
+/** How a site source publishes, for a message of the form "published by ...". */
+function describeSiteSource(source) {
+    switch (source) {
+        case 'actions':
+            return 'workflow deploys';
+        case 'repository':
+            return 'the repository itself, from its default branch';
+        default:
+            return 'copying files';
+    }
+}
+/**
+ * Whether a push that moved `ref` should republish this repository's site:
+ * only a 'repository' site that is enabled, and only for the default branch.
+ */
+async function siteFollowsRef(repo, ref, settings = (0, sitesettings_1.siteSettings)(repo.dir)) {
+    if (!settings.enabled || settings.source !== 'repository')
+        return false;
+    const branch = await repo.defaultBranch(await repo.listRefs('heads'));
+    return branch !== null && ref === `refs/heads/${branch}`;
+}
+/**
+ * Write the site directory from the default branch's tree, or from `path`
+ * within it. Returns the number of files published, or null when the settings
+ * do not ask for it (not enabled, or another source): a caller may call this
+ * unconditionally after anything that might have changed what the site should
+ * hold. Throws SitePublishError when the settings ask for it and it cannot be
+ * done: no default branch yet, a directory the branch does not have, or a tree
+ * with no files in it.
+ */
+async function publishSiteFromRepository(root, repo) {
+    const settings = (0, sitesettings_1.siteSettings)(repo.dir);
+    if (!settings.enabled || settings.source !== 'repository')
+        return null;
+    const branch = await repo.defaultBranch(await repo.listRefs('heads'));
+    if (!branch)
+        throw new SitePublishError('the repository has no default branch to publish the site from');
+    const spec = settings.path ? `${branch}:${settings.path}` : branch;
+    const what = settings.path ? `the directory ${settings.path} on ${branch}` : `the branch ${branch}`;
+    const tar = `${(0, layout_1.repoPath)(root, repo.collection, `${(0, scan_1.displayName)(repo.name)}.site`)}.archive-${process.pid}.tar`;
+    fs.rmSync(tar, { force: true });
+    try {
+        try {
+            // `--` is not accepted by git archive between the tree-ish and the
+            // paths, so the spec is kept from looking like an option by the branch
+            // name rules (no leading dash) and by isUsableSitePath.
+            await (0, git_1.execGit)(repo.dir, ['archive', '--format=tar', '-o', tar, spec]);
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (/not a tree object|not a valid object name|Not a valid object name|no such ref|did not match any files/i.test(msg)) {
+                throw new SitePublishError(`${what} does not exist, so there is nothing to publish`);
+            }
+            throw new SitePublishError(`git archive failed for ${what}: ${msg}`);
+        }
+        try {
+            return await (0, artifacts_1.installSiteFromTar)(root, repo.collection, repo.name, tar, { unwrapPagesArtifact: false, what });
+        }
+        catch (e) {
+            if (e instanceof artifacts_1.ArtifactError)
+                throw new SitePublishError(e.message);
+            throw e;
+        }
+    }
+    finally {
+        fs.rmSync(tar, { force: true });
+    }
+}
+/**
+ * The publish that follows a push: republish when the moved ref is the one the
+ * site follows, and otherwise do nothing. Errors are logged rather than
+ * thrown, since by the time this runs the push has been accepted and the
+ * pusher has gone; the settings page and the API report the same failure
+ * when the site is next saved, which is where a person can act on it.
+ */
+async function publishSiteAfterPush(root, repo, ref) {
+    try {
+        if (!(await siteFollowsRef(repo, ref)))
+            return;
+        const result = await publishSiteFromRepository(root, repo);
+        if (result)
+            console.log(`site for ${repo.collection}/${repo.name} published from ${ref}: ${result.files} file(s)`);
+    }
+    catch (e) {
+        console.error(`site publish for ${repo.collection}/${repo.name} failed: ${e instanceof Error ? e.message : e}`);
+    }
+}
+/**
+ * The result of a publish attempted because settings changed, in the shape
+ * the settings page and the PATCH route hand back: what was published, or
+ * why it was not.
+ */
+async function publishSiteForSettings(root, repo) {
+    try {
+        return await publishSiteFromRepository(root, repo);
+    }
+    catch (e) {
+        if (e instanceof SitePublishError)
+            return { error: e.message };
+        throw e;
+    }
+}
+/** Whether the site directory exists, for messages that say what happened. */
+function siteDirExists(root, collection, repo) {
+    try {
+        return fs.statSync(path.join((0, layout_1.repoPath)(root, collection, `${(0, scan_1.displayName)(repo)}.site`))).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}