@magland/mochi 0.3.1 → 0.4.1

package/dist/import-cli.js

@@ -36,11 +36,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.importCmd = importCmd;
 exports.collectionAddCmd = collectionAddCmd;
 exports.collectionListCmd = collectionListCmd;
-const child_process_1 = require("child_process");
+exports.forkCmd = forkCmd;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const cli_api_1 = require("./cli-api");
+const gitrun_1 = require("./cli/gitrun");
 const scan_1 = require("./scan");
 const source_1 = require("./source");
 function parseImportArgs(args, usage) {
@@ -100,24 +101,11 @@ function parseImportArgs(args, usage) {
     }
     return out;
 }
-/** Run git with its output going straight to the terminal, so a long clone shows progress. */
 function git(args, env) {
-    return new Promise((resolve, reject) => {
-        const child = (0, child_process_1.spawn)('git', args, { stdio: 'inherit', env: env ?? process.env });
-        child.on('error', (e) => reject(new Error(e.code === 'ENOENT' ? 'git is not on PATH' : String(e.message))));
-        child.on('close', (code) => resolve(code ?? 1));
-    });
+    return (0, gitrun_1.run)('git', args, env);
 }
-// The token is handed to the push through a helper that reads it from the
-// environment rather than through the command line, where every process on the
-// machine could read it. The empty helper first clears the list, so the answer
-// comes from here and nowhere else, and no prompt can appear.
-function pushEnv(username, token) {
-    return { ...process.env, MOCHI_USER: username, MOCHI_TOKEN: token, GIT_TERMINAL_PROMPT: '0' };
-}
-const CREDENTIAL_HELPER = `!f() { test "$1" = get && printf 'username=%s\\npassword=%s\\n' "$MOCHI_USER" "$MOCHI_TOKEN"; }; f`;
 function pushArgs(dir) {
-    return ['-C', dir, '-c', 'credential.helper=', '-c', `credential.helper=${CREDENTIAL_HELPER}`];
+    return ['-C', dir, ...(0, gitrun_1.mochiCredentialArgs)()];
 }
 /**
  * A repository's one-line description is not part of its git data, so a clone
@@ -144,14 +132,20 @@ async function githubDescription(gh) {
         return null;
     }
 }
-async function importCmd(args, usage) {
+async function importCmd(args, usage, mode = {}) {
     const a = parseImportArgs(args, usage);
+    const cmd = mode.fork ? 'fork' : 'import';
     if (!a.src) {
-        console.error('Usage: mochi import <source> <collection>[/<name>]');
-        console.error("  e.g. mochi import https://github.com/octocat/Hello-World mycollection");
+        console.error(`Usage: mochi ${cmd} <source> <collection>[/<name>]`);
+        console.error(`  e.g. mochi ${cmd} https://github.com/octocat/Hello-World mycollection`);
         process.exit(1);
     }
     const source = (0, source_1.parseSource)(a.src);
+    if (mode.fork && source && path.isAbsolute(source.url)) {
+        console.error('A fork records the URL it came from, and a local directory has no URL to record.');
+        console.error(`Use mochi import instead: mochi import ${a.src} <collection>`);
+        process.exit(1);
+    }
     if (!source) {
         console.error(`Not a source we can clone: ${a.src}`);
         console.error('Give an https or ssh git URL, owner/repo for GitHub, or the path to a repository here.');
@@ -161,7 +155,7 @@ async function importCmd(args, usage) {
     const name = a.name ?? source.name;
     if (!collection) {
         console.error(`Which collection should ${name} go into?`);
-        console.error(`  mochi import ${a.src} mycollection`);
+        console.error(`  mochi ${cmd} ${a.src} mycollection`);
         process.exit(1);
     }
     if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(name)) {
@@ -186,7 +180,7 @@ async function importCmd(args, usage) {
         console.error(`${collection}/${name} already exists on ${target.host}.`);
         console.error('A mirror push would replace its branches and tags, so this stops here. Import');
         console.error('under another name,');
-        console.error(`  mochi import ${a.src} ${collection}/another-name`);
+        console.error(`  mochi ${cmd} ${a.src} ${collection}/another-name`);
         console.error('or delete the existing repository first, from its settings page.');
         process.exit(1);
     }
@@ -217,7 +211,7 @@ async function importCmd(args, usage) {
             }
         }
         console.log(`Pushing to ${dest} as ${username}`);
-        const env = pushEnv(username, target.token);
+        const env = (0, gitrun_1.mochiCredentialEnv)(username, target.token);
         if ((await git([...pushArgs(tmp), 'push', '--mirror', dest], env)) !== 0) {
             throw new Error(`Could not push to ${dest}.\nIf it refused the token, check that you may create in ${collection}.`);
         }
@@ -233,8 +227,23 @@ async function importCmd(args, usage) {
         // here would skip this and leave the bare clone behind.
         cleanup();
     }
-    // The description is set after the push rather than before it, since the
-    // repository does not exist until the push creates it.
+    // A fork remembers where it came from: the source URL lands in the
+    // repository's config as mochi.upstream, where the repo header, `mochi
+    // sync`, and `mochi pr export` read it back. Recorded after the push, since
+    // the repository does not exist until the push creates it.
+    let upstream = null;
+    if (mode.fork) {
+        const patch = await (0, cli_api_1.apiTry)(target, 'PATCH', `/api/repos/${encodeURIComponent(collection)}/${encodeURIComponent(name)}`, {
+            upstream: source.url,
+        });
+        if (patch.ok)
+            upstream = source.url;
+        else {
+            console.error(`The repository arrived, but its upstream could not be recorded: ${patch.data.error ?? `HTTP ${patch.status}`}`);
+            console.error(`  mochi repo edit ${collection}/${name} --upstream ${source.url}`);
+        }
+    }
+    // The description too is set after the push rather than before it.
     let described = a.description?.trim() || null;
     if (!described && !a.noDescription && source.github)
         described = await githubDescription(source.github);
@@ -248,8 +257,10 @@ async function importCmd(args, usage) {
         }
     }
     console.log('');
-    console.log(`Imported ${collection}/${name}`);
+    console.log(`${mode.fork ? 'Forked' : 'Imported'} ${collection}/${name}`);
     console.log(`  ${dest}`);
+    if (upstream)
+        console.log(`  forked from ${upstream}`);
     // Worth saying rather than leaving to be discovered: a mirror push carries
     // LFS pointer files, so the files look present and read as missing.
     if (described)
@@ -314,3 +325,7 @@ async function collectionListCmd(args, usage) {
         console.log(`${c.name.padEnd(width)}  ${c.repoCount} ${c.repoCount === 1 ? 'repository' : 'repositories'}`);
     }
 }
+/** `mochi fork`: `mochi import` that records where the repository came from. */
+function forkCmd(args, usage) {
+    return importCmd(args, usage, { fork: true });
+}

package/dist/index.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const credentials_1 = require("./credentials");
@@ -52,6 +53,7 @@ const output_1 = require("./cli/output");
 const parse_1 = require("./cli/parse");
 const target_1 = require("./cli/target");
 const import_cli_1 = require("./import-cli");
+const sync_cmd_1 = require("./cli/sync-cmd");
 const deploy_cli_1 = require("./deploy-cli");
 const deploy_runner_cli_1 = require("./deploy-runner-cli");
 const job_cli_1 = require("./job-cli");
@@ -72,7 +74,7 @@ no keyring and possibly no writable home directory.
 
 Vault layout, where <repos> is <vault>/collections/<collection>/repos:
   <repos>/<repo>.git                 bare repositories (the .git suffix is optional)
-  <repos>/<repo>.site                optional static site for a repo
+  <repos>/<repo>.site                static site for a repo, served once enabled in its settings
   <repos>/<repo>.lfs                 Git LFS objects, when no bucket is configured
   <repos>/<repo>.runs                workflow run history and logs
   <vault>/vault.json                 users and hashed tokens (server-managed)
@@ -129,6 +131,22 @@ async function serveCmd(args, usage) {
     // in a loop should not pay for the server it is not starting.
     const { createApp } = await Promise.resolve().then(() => __importStar(require('./server')));
     const app = createApp(vault);
+    // What one request cannot be allowed to do is take the vault down for
+    // everyone else. Node's default for an uncaught exception or an unhandled
+    // rejection is to exit, on the reasoning that the process may be left in
+    // a state nothing can trust. That reasoning is weaker here than usual: the
+    // process holds no state that matters -- the vault is on disk, written by
+    // rename, and re-read on every request -- so what an escaped error has
+    // corrupted is at most one response, which is already lost. So the error is
+    // logged with its stack and the process goes on. Anything that recurs will
+    // recur in the log, which is where an operator can find it; a crash would
+    // have said the same thing once and then stopped serving.
+    process.on('uncaughtException', (err) => {
+        console.error('uncaught exception (the server continues):', err);
+    });
+    process.on('unhandledRejection', (reason) => {
+        console.error('unhandled rejection (the server continues):', reason);
+    });
     app.listen(port, host, () => {
         const url = `http://${host === '0.0.0.0' ? 'localhost' : host}:${port}`;
         if (boot && boot.preset) {
@@ -408,6 +426,37 @@ async function loginCmd(inv) {
     console.log(`and mochi commands talk to it by default (${(0, credentials_1.loginPath)()}).`);
     console.log('Run `mochi logout` to remove it again.');
 }
+// ---- web ----
+// Best effort and platform-shaped. The URL is printed first, so a machine
+// with no opener, or an SSH session, still leaves the person one paste away.
+function openBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        const child = (0, child_process_1.spawn)(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // The link is already on the terminal.
+    }
+}
+async function webCmd(inv) {
+    const target = await (0, target_1.targetFrom)(inv);
+    const next = inv.args[0] ?? '/';
+    const data = await (0, cli_api_1.api)(target, 'POST', '/api/login-url', { next });
+    const json = (0, output_1.jsonMode)(inv);
+    if (json.enabled) {
+        (0, output_1.printJson)((0, output_1.pickObject)(data, json.fields));
+        return;
+    }
+    console.log(`A one-time sign-in link for '${data.username}' at ${target.host}:`);
+    console.log('');
+    console.log(`  ${data.url}`);
+    console.log('');
+    console.log(`It works once, expires in ${data.expiresInSeconds} seconds, and asks before signing in.`);
+    openBrowser(String(data.url));
+}
 async function logoutCmd(inv) {
     if (inv.str('token') || inv.str('helper')) {
         throw new exit_1.CliError('logout takes only --host: it removes a stored credential rather than making one.', exit_1.EXIT_USAGE);
@@ -463,6 +512,16 @@ Options:
   --lfs                    carry Git LFS objects too
   --description <text>     set this description instead of the source's
   --no-description         leave the description empty`, import_cli_1.importCmd),
+    raw(['fork'], 'Import a repository and remember where it came from', `Usage: mochi fork <source> <collection>[/<name>] [--lfs]
+
+Everything mochi import does, plus the source URL is recorded as the
+repository's upstream, which the repository header shows, mochi sync
+fast-forwards from, and mochi pr export sends pull requests back to. The
+source must be a URL (or owner/repo for GitHub): a local directory has no
+upstream to record.
+
+Options are those of mochi import.`, import_cli_1.forkCmd),
+    sync_cmd_1.syncCommand,
     raw(['collection', 'add'], 'Create an empty collection', `Pushing to a new path creates its collection on the way, so this is for the
 other order: making the collection first and filling it afterwards.`, import_cli_1.collectionAddCmd),
     raw(['collection', 'list'], "Show the vault's collections and how many repositories each holds", '', import_cli_1.collectionListCmd),
@@ -580,6 +639,20 @@ nothing when that is nothing.`,
         ],
         run: loginCmd,
     },
+    {
+        path: ['web'],
+        summary: 'Open the vault in a browser, signed in as you',
+        description: `Mints a one-time sign-in link from the stored token and opens it in the
+default browser (the link is printed too, for machines without one). The link
+lands on a page that names the account and signs in on a click; it works once
+and expires after two minutes. The browser session is bound to the same token
+this CLI holds, so revoking that token signs the browser out as well.
+
+An optional path says where to land: mochi web /alice/myrepo`,
+        args: [{ name: 'path' }],
+        options: [output_1.JSON_OPTION, ...target_1.TARGET_OPTIONS],
+        run: webCmd,
+    },
     {
         path: ['logout'],
         summary: "Remove this vault's stored credential and forget the vault",
@@ -612,9 +685,11 @@ Docker rather than Fly's builder. --image <ref> deploys some other published tag
 See also: mochi deploy fly show <app>, mochi deploy fly destroy <app>.
 `, deploy_cli_1.deployFlyCmd),
     raw(['deploy', 'fly', 'runner'], 'Put a workflow runner on Fly.io, which stops when idle', `Usage: mochi deploy fly runner <app> [--allow <glob>...] [--labels <l,...>]
-                                   [--idle <5m>] [--region <r>] [--volume <gb>]
+                                   [--job-timeout <45m>] [--idle <5m>]
+                                   [--region <r>] [--volume <gb>]
                                    [--vm-size <s>] [--vm-memory <m>] [--org <o>]
                                    [--image <ref> | --from-source [--local-build]]
+                                   [--image-only]
 
 Needs flyctl, and a login to the vault this runner will serve. Registers the
 runner (named after the app unless --name says otherwise), creates the app and a
@@ -630,17 +705,42 @@ it costs while stopped is the volume alone.
 take jobs for; it executes whatever their workflows contain, on this machine.
 Run the same command again to deploy a new version.
 
+--job-timeout is the longest a single job may run on the machine, 20 minutes by
+default, which on hardware billed by the minute is the bound worth setting: it
+caps what a workflow's own timeout-minutes may ask for.
+
+--image-only moves an already-deployed runner to a new image and touches
+nothing else: no registration, no token, no wake rewrite, so it needs flyctl
+and no vault login. A runner and the vault it serves speak one protocol, so
+the pipeline that redeploys the vault should redeploy the runner beside it,
+and this flag is what lets a job holding only a Fly credential do that.
+
 See also: mochi deploy fly runner show <app>, destroy <app>, mochi runner list.
 `, deploy_runner_cli_1.deployFlyRunnerCmd),
     raw(['deploy', 'fly', 'runner', 'show'], 'What Fly has for this runner app, and which runner it serves', '', deploy_runner_cli_1.deployFlyRunnerShowCmd),
     raw(['deploy', 'fly', 'runner', 'destroy'], 'Destroy the runner app, and offer to remove its registration', 'No undo, though a runner keeps nothing that matters. Pass --yes to skip the confirmation.', deploy_runner_cli_1.deployFlyRunnerDestroyCmd),
     raw(['deploy', 'fly', 'show'], 'What Fly has for this app, and whether the vault answers', '', deploy_cli_1.deployShowCmd),
     raw(['deploy', 'fly', 'destroy'], 'Destroy the app and its volume, and with them the vault', 'No undo. Pass --yes to skip the confirmation.', deploy_cli_1.deployDestroyCmd),
-    raw(['runner', 'add'], 'Register a machine that will execute workflow jobs', `Usage: mochi runner add <name> --allow <glob>... [--labels <l,...>] [--save]
+    raw(['runner', 'add'], 'Register a machine that will execute workflow jobs', `Usage: mochi runner add <name> --allow <glob>... [--labels <l,...>]
+                        [--job-timeout <45m>] [--save]
 
 Prints its token once. --allow says which repositories it may take jobs for, as
 globs over collection/repo; you must own every collection they name (a site admin may name any). Jobs never run on
-the vault's machine, so a vault with no runner queues its runs and waits.`, runner_cli_1.runnerAddCmd),
+the vault's machine, so a vault with no runner queues its runs and waits.
+
+--job-timeout is the longest a single job may run on this machine, 20 minutes by
+default and stated in minutes or as a duration like 2h. It is a ceiling on what
+a job's own timeout-minutes may ask for, not a default it can override; change
+it later with mochi runner edit.`, runner_cli_1.runnerAddCmd),
+    raw(['runner', 'edit'], "Change a registered runner's job timeout", `Usage: mochi runner edit <name> --job-timeout <45m|default>
+
+The longest a single job may run on that machine. A job asking for less with
+timeout-minutes keeps what it asked for; one asking for more, or asking for
+nothing, is held to this. --job-timeout default puts the runner back on the
+vault's own default of 20 minutes.
+
+Applies to the next job the runner takes: one already running keeps the timeout
+it was handed with the job.`, runner_cli_1.runnerEditCmd),
     raw(['runner', 'run'], 'Take jobs and run them, one at a time, each in a Docker container', `Usage: mochi runner run [--host <url>] [--runner-token <t>] [--labels <l,...>]
 
 Reads ~/.config/mochi/runner.json when given no arguments. Needs a working
@@ -653,6 +753,12 @@ on the next run; --no-action-cache downloads every time. --work-dir sets where
 job workspaces are made, --network which Docker network the container joins,
 and MOCHI_RUNNER_TOKEN supplies the token instead of --runner-token.
 
+Each job runs in a container of its own, held to --job-pids <4096> processes
+(0 for no limit) and, when given, --job-memory <2g> and --job-cpus <2>, as
+docker run takes them. A job over the process limit cannot fork; one over the
+memory limit is killed. There is no default for memory or CPU, since the right
+figure is the machine's to decide.
+
 --idle <5m> stops the runner when no job has arrived for that long, which is
 what makes a runner that costs money while it is up affordable: it exits, and
 whatever hosts it stops. Something then has to start it again, so --wake-port

package/dist/issueweb.js

@@ -40,6 +40,7 @@ const icons_1 = require("./icons");
 const issues = __importStar(require("./issues"));
 const html_1 = require("./html");
 const markdown_1 = require("./markdown");
+const mdedit_1 = require("./mdedit");
 const ops_1 = require("./ops");
 const render_1 = require("./render");
 const session_1 = require("./session");
@@ -69,6 +70,7 @@ function body(ctx, text) {
         blobBase: `${base}/blob/${ref}`,
         issueBase: `${base}/issues`,
         commitBase: `${base}/commit`,
+        mentions: ctx.hasUser,
     }));
 }
 function stateBadge(state) {
@@ -117,7 +119,7 @@ function listPage(ctx, list, filter, counts, labels, authors) {
     const rows = list.map((i) => (0, html_1.html) `<tr>
 <td class="issue-cell">${(0, icons_1.icon)(i.state === 'open' ? 'issue-opened' : 'issue-closed', i.state === 'open' ? 'issue-open' : 'issue-closed')}<span>
 <a class="issue-link" href="${base}/${i.number}">${i.title}</a>${labelChips(i.labels, base, filter)}
-<div class="muted small">#${i.number} opened ${(0, render_1.timeTag)(i.created)} by ${i.author}${i.state === 'closed' && i.closedAt ? (0, html_1.html) ` &middot; closed ${(0, render_1.timeTag)(i.closedAt)}` : ''}</div></span></td>
+<div class="muted small">#${i.number} opened ${(0, render_1.timeTag)(i.created)} by ${(0, views_1.userLink)(i.author)}${i.state === 'closed' && i.closedAt ? (0, html_1.html) ` &middot; closed ${(0, render_1.timeTag)(i.closedAt)}` : ''}</div></span></td>
 <td class="right muted small">${i.comments > 0
         ? (0, html_1.html) `<a class="issue-comments" href="${base}/${i.number}" title="${i.comments} comment${i.comments === 1 ? '' : 's'}">${(0, icons_1.icon)('comment')}<span>${i.comments}</span></a>`
         : ''}</td>
@@ -183,7 +185,7 @@ ${rows.length
 }
 function commentCard(author, when, rendered, note = '') {
     return (0, html_1.html) `<article class="issue-comment">
-<div class="issue-comment-head">${(0, avatar_1.avatar)(author, 24)}<b>${author}</b><span class="muted small">${note || 'commented'} ${(0, render_1.timeTag)(when)}</span></div>
+<div class="issue-comment-head">${(0, views_1.userLink)(author, { face: 24, bold: true })}<span class="muted small">${note || 'commented'} ${(0, render_1.timeTag)(when)}</span></div>
 <div class="issue-comment-body markdown-body">${rendered}</div>
 </article>`;
 }
@@ -194,7 +196,7 @@ function issuePage(ctx, issue, canWrite) {
     const canClose = canWrite || mine;
     const comments = issue.commentList.map((c) => commentCard(c.author, c.created, body(ctx, c.body)));
     const closedNote = issue.state === 'closed' && issue.closedAt
-        ? (0, html_1.html) `<div class="issue-event">${(0, icons_1.icon)('issue-closed', 'issue-closed')}<span><b>${issue.closedBy ?? 'someone'}</b> closed this ${(0, render_1.timeTag)(issue.closedAt)}</span></div>`
+        ? (0, html_1.html) `<div class="issue-event">${(0, icons_1.icon)('issue-closed', 'issue-closed')}<span>${issue.closedBy ? (0, views_1.userLink)(issue.closedBy, { bold: true }) : (0, html_1.html) `<b>someone</b>`} closed this ${(0, render_1.timeTag)(issue.closedAt)}</span></div>`
         : '';
     let replyBox;
     if (viewer) {
@@ -203,7 +205,7 @@ function issuePage(ctx, issue, canWrite) {
             : '';
         replyBox = (0, html_1.html) `<form class="issue-reply" method="post" action="${base}/${issue.number}/comment">${(0, views_1.csrfField)(viewer)}
 <div class="issue-comment-head">${(0, avatar_1.avatar)(viewer.auth.username, 24)}<b>${viewer.auth.username}</b></div>
-<textarea class="code-editor" name="body" rows="6" placeholder="Leave a comment"></textarea>
+${(0, mdedit_1.markdownEditor)({ name: 'body', rows: 6, placeholder: 'Leave a comment', preview: (0, mdedit_1.previewUrl)(ctx) })}
 <div class="actions">${toggle}<button class="btn btn-primary" type="submit">Comment</button></div>
 </form>`;
     }
@@ -219,7 +221,9 @@ function issuePage(ctx, issue, canWrite) {
   <h1 class="issue-title">${issue.title} <span class="muted">#${issue.number}</span></h1>
   <span class="right-group">${edit}<a class="btn" href="${base}">Back to issues</a></span>
 </div>
-<div class="issue-sub">${stateBadge(issue.state)}<span class="muted"><b>${issue.author}</b> opened this ${(0, render_1.timeTag)(issue.created)} &middot; ${issue.commentList.length} comment${issue.commentList.length === 1 ? '' : 's'}</span>${labelChips(issue.labels)}</div>
+<div class="issue-sub">${stateBadge(issue.state)}<span class="muted">${(0, views_1.userLink)(issue.author, {
+        bold: true,
+    })} opened this ${(0, render_1.timeTag)(issue.created)} &middot; ${issue.commentList.length} comment${issue.commentList.length === 1 ? '' : 's'}</span>${labelChips(issue.labels)}</div>
 <div class="issue-thread">
 ${commentCard(issue.author, issue.created, description.text ? description : (0, html_1.raw)('<p class="muted">No description.</p>'), 'opened this')}
 ${comments}
@@ -239,7 +243,7 @@ ${error ? (0, html_1.html) `<div class="form-error">${error}</div>` : ''}
 <div class="field"><label for="title">Title</label>
 <input type="text" id="title" name="title" value="${values.title}" maxlength="${issues.MAX_TITLE}" required autofocus></div>
 <div class="field"><label for="body">Description</label>
-<textarea class="code-editor" id="body" name="body" rows="12" placeholder="Markdown is welcome">${values.body}</textarea></div>
+${(0, mdedit_1.markdownEditor)({ name: 'body', id: 'body', rows: 12, placeholder: 'Markdown is welcome', value: values.body, preview: (0, mdedit_1.previewUrl)(ctx) })}</div>
 ${ctx.canPush
         ? (0, html_1.html) `<div class="field"><label for="labels">Labels</label>
 <input type="text" id="labels" name="labels" value="${values.labels.join(', ')}" placeholder="bug, ui">

package/dist/lfs.js

@@ -251,8 +251,15 @@ function registerLfs(app, root, lfs, authLimiter) {
                 };
             }
             // Already present: omitting actions tells the client to skip the
-            // upload; this is the deduplication mechanism.
-            if (info)
+            // upload; this is the deduplication mechanism. Present at the size
+            // the pointer claims, that is. A bucket takes whatever bytes a
+            // presigned PUT delivers, so a client that lied about the size in
+            // one batch and uploaded something else left an object under this
+            // id that is not this object; it fails verification, but it would
+            // otherwise also stand in for every honest upload of the real one
+            // from then on. An object of the wrong size is treated as absent
+            // and the upload it is given overwrites it.
+            if (info && info.size === o.size)
                 return { oid: o.oid, size: o.size, authenticated: true };
             if (o.size > maxSize) {
                 return {

package/dist/limit.js

@@ -218,7 +218,7 @@ function createGates(limits) {
 const AUTH_WINDOW_MS = 15 * 60 * 1000;
 const AUTH_MAX_KEYS = 20000;
 /** Bearer and runner tokens carry no username, so they share one bucket in the fine-grained window. */
-const NO_USERNAME = 'token';
+const NO_USERNAME = '\x00token';
 /**
  * A limiter charged only on failure, so a working credential is never throttled
  * however often it is used. That matters for /api/runner/*, which a runner calls
@@ -240,7 +240,7 @@ function createAuthLimiter(authFailures) {
     const coarse = createLimiter({ limit: authFailures * 5, windowMs: AUTH_WINDOW_MS, maxKeys: AUTH_MAX_KEYS });
     const keys = (req, username) => {
         const address = clientKey(req);
-        return { address, fine: `${address}${username ?? NO_USERNAME}` };
+        return { address, fine: `${address}\x00${username ?? NO_USERNAME}` };
     };
     return {
         allow(req, username) {

package/dist/logincodes.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANDOFF_TTL_MS = exports.LOGIN_LINK_TTL_MS = void 0;
+exports.mintLoginLink = mintLoginLink;
+exports.peekLoginLink = peekLoginLink;
+exports.takeLoginLink = takeLoginLink;
+exports.mintHandoff = mintHandoff;
+exports.takeHandoff = takeHandoff;
+const onetime_1 = require("./onetime");
+exports.LOGIN_LINK_TTL_MS = 2 * 60 * 1000;
+exports.HANDOFF_TTL_MS = 5 * 60 * 1000;
+const loginLinks = (0, onetime_1.createOneTimeStore)();
+const handoffCodes = (0, onetime_1.createOneTimeStore)(onetime_1.mintHandoffCode);
+function mintLoginLink(root, username, binding, next) {
+    return loginLinks.put({ root, username, binding, next }, exports.LOGIN_LINK_TTL_MS);
+}
+function peekLoginLink(root, code) {
+    const p = loginLinks.peek(code);
+    return p && p.root === root ? p : null;
+}
+function takeLoginLink(root, code) {
+    const p = loginLinks.take(code);
+    return p && p.root === root ? p : null;
+}
+function mintHandoff(root, username, binding) {
+    return handoffCodes.put({ root, username, binding }, exports.HANDOFF_TTL_MS);
+}
+function takeHandoff(root, typed) {
+    const p = handoffCodes.take((0, onetime_1.normalizeHandoffCode)(typed));
+    return p && p.root === root ? p : null;
+}