@magland/mochi 0.3.1 → 0.4.1

package/dist/maintenance.js

@@ -0,0 +1,297 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.repoNeedsGc = repoNeedsGc;
+exports.gcSweep = gcSweep;
+exports.runsSweep = runsSweep;
+exports.firstSweepDelay = firstSweepDelay;
+exports.startMaintenance = startMaintenance;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const artifacts_1 = require("./ci/artifacts");
+const runs_1 = require("./ci/runs");
+const config_1 = require("./config");
+const git_1 = require("./git");
+const layout_1 = require("./layout");
+const scan_1 = require("./scan");
+// Periodic upkeep: `git gc` over the repositories in the vault, and CI
+// retention over their run history (runsSweep, below).
+//
+// Git adds objects and never removes them. A force push, a branch deleted, a
+// history rewritten: each one leaves the commits, trees, and blobs it abandoned
+// in the object store, unreachable from any ref, still readable by anyone who
+// knows the hash, and still counted against the disk. Only a garbage collection
+// walks out from the refs and drops what it could not reach.
+//
+// Nothing else here runs one. Git's own automatic pass is tuned for a working
+// copy accumulating loose objects, and a bare repository on a forge receives
+// packs instead, so in practice it never fires. Without this sweep a vault
+// keeps every mistake anyone has ever pushed to it.
+//
+// What makes a sweep safe to run beside live traffic is the grace period. A
+// push uploads its objects before it moves the branch that will make them
+// reachable, so for a moment those objects look exactly like abandoned ones; a
+// collection that spared nothing could delete a push in flight. PRUNE_GRACE
+// keeps this one away from anything recent, which is also why it is not the
+// answer to "I pushed a secret, get it out now": that wants --prune=now, and
+// wants to know that nobody is mid-push.
+/** How often to sweep, measured from the end of the last sweep. */
+const SWEEP_MS = 6 * 60 * 60 * 1000;
+/**
+ * The soonest a sweep runs after the server starts, when one is due. Long
+ * enough that the request which woke a sleeping machine is answered before the
+ * sweep competes with it for the disk, and well inside the few idle minutes
+ * after which a scale-to-zero host stops the machine again.
+ */
+const MIN_SWEEP_DELAY_MS = 60 * 1000;
+/**
+ * Written at the vault root when a sweep finishes. Its mtime is what the next
+ * sweep is due from, so the schedule survives a restart: a vault on a host
+ * that stops it after a few idle minutes (Fly's autostop, say) never stays up
+ * for a timer counted from process start, and would otherwise never sweep at
+ * all. It is not vault state and backups leave it out (see ROOT_FILES in
+ * src/api/backup.ts); losing it costs one sweep sooner than needed.
+ */
+const SWEEP_STAMP = 'mochi-last-sweep';
+/**
+ * Objects unreachable but newer than this are kept. Two days is far longer than
+ * any push or clone this server will serve, and it is the whole safety
+ * argument for running gc unattended, so it is deliberately generous.
+ */
+const PRUNE_GRACE = '2.days.ago';
+/** A repository still collecting after this long is left to the next sweep. */
+const GC_TIMEOUT_MS = 30 * 60 * 1000;
+/**
+ * Written in the repository directory after a successful collection. Its mtime
+ * is the only state the sweep keeps, and losing it costs one extra gc.
+ */
+const STAMP = 'mochi-last-gc';
+// Queue depth, interval, and grace are constants rather than settings, as the
+// gate queues in src/limit.ts are: nobody tunes them without reading this
+// comment, and they can be promoted to config.json if anyone asks.
+function mtimeOf(file) {
+    try {
+        return fs.statSync(file).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+/** The newest mtime anywhere under dir, which is only walked for `refs`. */
+function newestUnder(dir) {
+    let newest = 0;
+    const visit = (p) => {
+        let stat;
+        try {
+            stat = fs.statSync(p);
+        }
+        catch {
+            return;
+        }
+        if (stat.mtimeMs > newest)
+            newest = stat.mtimeMs;
+        if (!stat.isDirectory())
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(p, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries)
+            visit(path.join(p, entry.name));
+    };
+    visit(dir);
+    return newest;
+}
+/**
+ * Whether anything has happened to this repository since it was last collected.
+ *
+ * Loose refs are walked, since `refs` holds one small file per branch and tag.
+ * The object store is not: `objects` and `objects/pack` change whenever a push
+ * lands, which is all this needs to know, and walking a real repository's
+ * fanout directories on every sweep would cost more than the gc it is deciding
+ * whether to run.
+ *
+ * Exported for the tests, which build a repository shape without a git binary.
+ */
+function repoNeedsGc(repoDir) {
+    const last = mtimeOf(path.join(repoDir, STAMP));
+    // Never collected: collect it, whatever its mtimes say.
+    if (last === 0)
+        return true;
+    const changed = Math.max(newestUnder(path.join(repoDir, 'refs')), mtimeOf(path.join(repoDir, 'packed-refs')), mtimeOf(path.join(repoDir, 'objects')), mtimeOf(path.join(repoDir, 'objects', 'pack')));
+    return changed > last;
+}
+/**
+ * Collect every repository that has changed since its last collection, one at a
+ * time, and return the names of the ones collected.
+ *
+ * Serial on purpose: a gc is CPU and disk bound, and a vault whose repositories
+ * all changed should spend one core on catching up rather than every core.
+ */
+async function gcSweep(root) {
+    const collected = [];
+    for (const { name: collection } of (0, scan_1.listCollections)(root)) {
+        for (const dirName of (0, scan_1.listRepoDirs)(root, collection)) {
+            const dir = (0, layout_1.repoPath)(root, collection, dirName);
+            const full = `${collection}/${(0, scan_1.displayName)(dirName)}`;
+            if (!repoNeedsGc(dir))
+                continue;
+            try {
+                await (0, git_1.execGit)(dir, ['gc', '--quiet', `--prune=${PRUNE_GRACE}`], { timeoutMs: GC_TIMEOUT_MS });
+            }
+            catch (e) {
+                // A gc that fails is not an outage, and the commonest reason is that
+                // another one holds the repository's gc.pid lock. No stamp is written,
+                // so the next sweep tries again.
+                console.error(`gc ${full}: ${e instanceof Error ? e.message : String(e)}`);
+                continue;
+            }
+            // After the gc, so that the work the gc itself did to `objects` and
+            // `packed-refs` does not read as a reason to collect again.
+            try {
+                fs.writeFileSync(path.join(dir, STAMP), '');
+            }
+            catch {
+                // Without a stamp the repository is collected again next sweep, which
+                // is wasteful and harmless.
+            }
+            collected.push(full);
+        }
+    }
+    return collected;
+}
+/**
+ * Apply CI retention to every repository, and delete the site artifacts that
+ * completed runs have already deployed. Returns the bytes of deployed
+ * artifacts removed.
+ *
+ * Retention is otherwise applied only when a repository starts a run, so a
+ * repository that has gone quiet keeps whatever it had, and lowering the run
+ * count in config.json would reach it never. This is also what clears the
+ * site archives kept by runs from before deploys deleted their own.
+ */
+function runsSweep(root) {
+    const retain = (0, config_1.loadConfig)(root).ci;
+    let freed = 0;
+    for (const { name: collection } of (0, scan_1.listCollections)(root)) {
+        for (const dirName of (0, scan_1.listRepoDirs)(root, collection)) {
+            const repo = (0, scan_1.displayName)(dirName);
+            try {
+                freed += (0, artifacts_1.pruneDeployedArtifacts)(root, collection, repo);
+                (0, runs_1.pruneRuns)(root, collection, repo, retain);
+            }
+            catch (e) {
+                console.error(`runs ${collection}/${repo}: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
+    }
+    return freed;
+}
+/**
+ * How long after starting to run the first sweep, given when the last one
+ * finished (0 for never). A sweep that is due runs MIN_SWEEP_DELAY_MS after
+ * start; one that is not waits out the rest of SWEEP_MS, so restarting a
+ * vault neither costs a sweep nor postpones one. A stamp from the future (a
+ * clock that moved) waits at most one full interval.
+ */
+function firstSweepDelay(lastSweepMs, now) {
+    const due = lastSweepMs + SWEEP_MS - now;
+    return Math.min(SWEEP_MS, Math.max(MIN_SWEEP_DELAY_MS, due));
+}
+/**
+ * Start the sweep. Returns a function that stops it, which the tests use;
+ * the server itself runs it for as long as it runs.
+ *
+ * The timer is unref'd, so a sweep pending is never the reason a process stays
+ * alive, and a sweep already running is never joined by a second one. A sweep
+ * cut short by the machine stopping writes no stamp, so it is due again on the
+ * next start; the per-repository gc stamps mean it resumes rather than repeats.
+ */
+function startMaintenance(root) {
+    let running = false;
+    let timer = null;
+    let stopped = false;
+    const stampFile = path.join(root, SWEEP_STAMP);
+    const schedule = (delay) => {
+        if (stopped)
+            return;
+        timer = setTimeout(() => void tick(), delay);
+        timer.unref();
+    };
+    const tick = async () => {
+        if (running)
+            return;
+        running = true;
+        try {
+            const freed = runsSweep(root);
+            if (freed > 0)
+                console.log(`runs: removed ${Math.round(freed / 1048576)} MB of deployed site artifacts`);
+        }
+        catch (e) {
+            console.error(`runs sweep: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        try {
+            const collected = await gcSweep(root);
+            if (collected.length > 0) {
+                console.log(`gc: collected ${collected.length} repositor${collected.length === 1 ? 'y' : 'ies'}`);
+            }
+        }
+        catch (e) {
+            console.error(`gc sweep: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        finally {
+            running = false;
+        }
+        // Written even when a part of the sweep failed: those failures are logged,
+        // and retrying them on every start of a machine that wakes many times a
+        // day would turn one bad repository into constant work.
+        try {
+            fs.writeFileSync(stampFile, '');
+        }
+        catch (e) {
+            console.error(`sweep stamp: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        schedule(SWEEP_MS);
+    };
+    schedule(firstSweepDelay(mtimeOf(stampFile), Date.now()));
+    return () => {
+        stopped = true;
+        if (timer)
+            clearTimeout(timer);
+    };
+}

package/dist/markdown.js

@@ -54,6 +54,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_CONTENT_PREFIX = void 0;
 exports.isMarkdownFile = isMarkdownFile;
 exports.renderMarkdown = renderMarkdown;
 const crypto = __importStar(require("crypto"));
@@ -71,6 +72,17 @@ const views_1 = require("./views");
 // of a longer word, and a commit id must contain at least one letter, so that
 // a plain number written in passing is not mistaken for one.
 const CROSS_REF = /(?<![\w#/-])(?:#(\d{1,9})|([0-9a-f]{7,40}))(?![\w-])/g;
+// GitHub's @mentions: an @ followed by something shaped like a username (see
+// isValidUserName in src/scan.ts). The pattern refuses an @ that ends a word,
+// so an email address written in passing is not half-linked. The match is
+// greedy over the username characters; trailing punctuation that keeps the
+// name from resolving is peeled off afterwards, so "@bob." mentions bob.
+const MENTION = /(?<![\w@.-])@([A-Za-z0-9][A-Za-z0-9._-]*)/g;
+// A channel named in passing: # and a channel's name, lowercase letters,
+// digits, and hyphens. As with a mention, a # inside a word (a URL's
+// fragment, an HTML entity) is refused, and a trailing hyphen that keeps the
+// name from resolving is peeled off.
+const CHANNEL_REF = /(?<![\w#&/-])#([a-z0-9][a-z0-9-]*)/g;
 function isMarkdownFile(filename) {
     const base = filename.split('/').pop() ?? filename;
     return /\.(md|markdown)$/i.test(base);
@@ -124,9 +136,15 @@ const ALLOWED_TAGS = [
     'abbr', 'cite', 'q', 'input',
 ];
 // No `style` anywhere: an inline style on document content could cover the
-// rest of the page, which is a phishing surface even without scripting.
+// rest of the page, which is a phishing surface even without scripting. No
+// `class` either, for the same reason by another route: the stylesheet is
+// the interface's own, so `<div class="topbar">` in a README would stick to
+// the top of the page over the real one, with a Sign in button of its own.
+// The classes the renderer itself emits are allowed by name below, and only
+// on the elements it emits them on; a class an author wrote is dropped, as
+// GitHub drops it. `id` stays, prefixed (see userContentId).
 const ALLOWED_ATTRS = {
-    '*': ['id', 'class', 'title', 'align', 'dir', 'lang', 'role', 'aria-label', 'aria-hidden'],
+    '*': ['id', 'title', 'align', 'dir', 'lang', 'role', 'aria-label', 'aria-hidden'],
     a: ['href', 'name', 'target', 'rel'],
     img: ['src', 'alt', 'width', 'height', 'loading'],
     th: ['colspan', 'rowspan', 'scope', 'valign'],
@@ -138,19 +156,56 @@ const ALLOWED_ATTRS = {
     details: ['open'],
     input: ['type', 'checked', 'disabled'],
 };
+// What the renderer puts a class on, and which. Anything else is an author's
+// and is dropped; see ALLOWED_ATTRS. The footnote entries are
+// markdown-it-footnote's own markup.
+const ALLOWED_CLASSES = {
+    code: [/^language-[A-Za-z0-9_+#.-]+$/, 'math-error'],
+    div: ['code-block', 'math-block'],
+    blockquote: ['alert', /^alert-(note|tip|important|warning|caution)$/],
+    p: ['alert-title'],
+    li: ['task-item', 'footnote-item'],
+    a: ['heading-anchor', 'footnote-backref'],
+    sup: ['footnote-ref'],
+    hr: ['footnotes-sep'],
+    section: ['footnotes'],
+    ol: ['footnotes-list'],
+};
+/**
+ * The prefix every id in a rendered document carries. The document and the
+ * page around it share one id space, and the page's script finds its own
+ * elements by id: a README with `<div id="jump">` would otherwise be what
+ * openJump() found and tried to show as a dialog. GitHub prefixes with the
+ * same word. Links within the document (`#install`, a footnote's `#fn1`, a
+ * heading's own anchor) are rewritten to match, so a document's table of
+ * contents keeps working; a link from outside the document to `/repo#install`
+ * finds nothing by that name, and the page script takes it to the prefixed
+ * element instead (followHash in src/pagescript.ts).
+ */
+exports.USER_CONTENT_PREFIX = 'user-content-';
+function prefixId(attribs) {
+    if (attribs.id !== undefined && attribs.id !== '')
+        attribs.id = exports.USER_CONTENT_PREFIX + attribs.id;
+}
 function sanitizeOptions(opts) {
     return {
         allowedTags: ALLOWED_TAGS,
         allowedAttributes: ALLOWED_ATTRS,
+        allowedClasses: ALLOWED_CLASSES,
         allowedSchemes: ['http', 'https', 'mailto', 'ftp'],
         allowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],
         allowProtocolRelative: false,
+        ...(opts.showRefusedHtml ? { disallowedTagsMode: 'escape', nonTextTags: [] } : {}),
         transformTags: {
             // Rewriting here rather than in a renderer rule covers links written as
             // markdown and links written as HTML with one implementation.
             a: (tagName, attribs) => {
                 const href = attribs.href;
-                if (href && isRelative(href)) {
+                if (href && href.startsWith('#')) {
+                    if (href.length > 1)
+                        attribs.href = `#${exports.USER_CONTENT_PREFIX}${href.slice(1)}`;
+                }
+                else if (href && isRelative(href)) {
                     attribs.href = resolveRef(href, opts.blobBase);
                 }
                 else if (href && /^https?:/i.test(href)) {
@@ -165,6 +220,12 @@ function sanitizeOptions(opts) {
                 attribs.loading = 'lazy';
                 return { tagName, attribs };
             },
+            // Every element, the two above included: sanitize-html applies this
+            // entry and then the element's own, so the id prefix lives here alone.
+            '*': (tagName, attribs) => {
+                prefixId(attribs);
+                return { tagName, attribs };
+            },
         },
     };
 }
@@ -276,6 +337,135 @@ function buildMarkdownIt() {
                 block.children = out;
         }
     });
+    // Mentions ride the same shape as mochi_refs above: a core rule over the
+    // inline token stream, leaving text inside links alone. It runs after the
+    // refs rule, so a mention never lands inside a link that rule just made.
+    md.core.ruler.push('mochi_mentions', (state) => {
+        const mentions = state.env.opts.mentions;
+        if (!mentions)
+            return;
+        for (const block of state.tokens) {
+            if (block.type !== 'inline' || !block.children)
+                continue;
+            const out = [];
+            let inLink = 0;
+            let changed = false;
+            for (const token of block.children) {
+                if (token.type === 'link_open')
+                    inLink++;
+                else if (token.type === 'link_close')
+                    inLink--;
+                if (token.type !== 'text' || inLink > 0) {
+                    out.push(token);
+                    continue;
+                }
+                let last = 0;
+                MENTION.lastIndex = 0;
+                for (let m = MENTION.exec(token.content); m; m = MENTION.exec(token.content)) {
+                    // Dots, dashes, and underscores are legal in a username and common
+                    // as the punctuation right after one: "@bob." at the end of a
+                    // sentence means bob. Trailing punctuation is peeled only while the
+                    // name does not resolve, so a username that really ends that way
+                    // still wins.
+                    let name = m[1];
+                    while (name !== '' && !mentions(name)) {
+                        const cut = name.search(/[._-]+$/);
+                        if (cut === -1) {
+                            name = '';
+                            break;
+                        }
+                        name = name.slice(0, cut);
+                    }
+                    if (name === '')
+                        continue;
+                    if (m.index > last) {
+                        const before = new state.Token('text', '', 0);
+                        before.content = token.content.slice(last, m.index);
+                        out.push(before);
+                    }
+                    const open = new state.Token('link_open', 'a', 1);
+                    open.attrSet('href', `/${encodeURIComponent(name)}`);
+                    const label = new state.Token('text', '', 0);
+                    label.content = `@${name}`;
+                    const close = new state.Token('link_close', 'a', -1);
+                    out.push(open, label, close);
+                    last = m.index + 1 + name.length;
+                    MENTION.lastIndex = last;
+                    changed = true;
+                }
+                if (last === 0) {
+                    out.push(token);
+                }
+                else if (last < token.content.length) {
+                    const rest = new state.Token('text', '', 0);
+                    rest.content = token.content.slice(last);
+                    out.push(rest);
+                }
+            }
+            if (changed)
+                block.children = out;
+        }
+    });
+    // Channel names, by the mentions rule's shape and after it.
+    md.core.ruler.push('mochi_channels', (state) => {
+        const channels = state.env.opts.channels;
+        if (!channels)
+            return;
+        for (const block of state.tokens) {
+            if (block.type !== 'inline' || !block.children)
+                continue;
+            const out = [];
+            let inLink = 0;
+            let changed = false;
+            for (const token of block.children) {
+                if (token.type === 'link_open')
+                    inLink++;
+                else if (token.type === 'link_close')
+                    inLink--;
+                if (token.type !== 'text' || inLink > 0) {
+                    out.push(token);
+                    continue;
+                }
+                let last = 0;
+                CHANNEL_REF.lastIndex = 0;
+                for (let m = CHANNEL_REF.exec(token.content); m; m = CHANNEL_REF.exec(token.content)) {
+                    let name = m[1];
+                    let href = channels(name);
+                    while (href === null && /-$/.test(name)) {
+                        name = name.replace(/-+$/, '');
+                        href = name === '' ? null : channels(name);
+                    }
+                    if (href === null)
+                        continue;
+                    if (m.index > last) {
+                        const before = new state.Token('text', '', 0);
+                        before.content = token.content.slice(last, m.index);
+                        out.push(before);
+                    }
+                    const open = new state.Token('link_open', 'a', 1);
+                    open.attrSet('href', href);
+                    const label = new state.Token('text', '', 0);
+                    label.content = `#${name}`;
+                    const close = new state.Token('link_close', 'a', -1);
+                    out.push(open, label, close);
+                    last = m.index + 1 + name.length;
+                    CHANNEL_REF.lastIndex = last;
+                    changed = true;
+                }
+                if (last === 0) {
+                    out.push(token);
+                }
+                else if (last < token.content.length) {
+                    const rest = new state.Token('text', '', 0);
+                    rest.content = token.content.slice(last);
+                    out.push(rest);
+                }
+            }
+            if (changed)
+                block.children = out;
+        }
+    });
+    md.renderer.rules.softbreak = (_tokens, _idx, options, env) => options.breaks || env.opts.breaks ? '<br>\n' : '\n';
     md.renderer.rules.fence = (tokens, idx, _options, env) => {
         const token = tokens[idx];
         const info = token.info.trim().split(/\s+/)[0].toLowerCase();

package/dist/mdedit.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.previewUrl = previewUrl;
+exports.markdownEditor = markdownEditor;
+const html_1 = require("./html");
+const icons_1 = require("./icons");
+const views_1 = require("./views");
+function previewUrl(ctx) {
+    return `${(0, views_1.repoUrl)(ctx)}/preview`;
+}
+function markdownEditor(o) {
+    const btn = (act, glyph, title) => (0, html_1.html) `<button type="button" class="md-btn" data-md-act="${act}" title="${title}" aria-label="${title}" tabindex="-1">${(0, icons_1.icon)(glyph)}</button>`;
+    const groups = [
+        (0, html_1.html) `<span class="md-group">${btn('heading', 'heading', 'Heading')}${btn('bold', 'bold', 'Bold (Ctrl+B)')}${btn('italic', 'italic', 'Italic (Ctrl+I)')}${btn('strike', 'strikethrough', 'Strikethrough')}</span>`,
+        (0, html_1.html) `<span class="md-group">${btn('quote', 'quote', 'Quote')}${btn('code', 'code', 'Code (Ctrl+E)')}${btn('link', 'link', 'Link (Ctrl+K)')}</span>`,
+        (0, html_1.html) `<span class="md-group">${btn('ul', 'list-unordered', 'Bulleted list')}${btn('ol', 'list-ordered', 'Numbered list')}${btn('task', 'tasklist', 'Task list')}</span>`,
+    ];
+    return (0, html_1.html) `<div class="md-editor" data-md-editor data-md-preview="${o.preview}"${o.ref ? (0, html_1.html) ` data-md-ref="${o.ref}"` : ''}${o.dir ? (0, html_1.html) ` data-md-dir="${o.dir}"` : ''}>
+<div class="md-head">
+<div class="md-tabs" role="tablist">
+<button type="button" class="md-tab current" data-md-pane="write" role="tab" aria-selected="true">Write</button>
+<button type="button" class="md-tab" data-md-pane="preview" role="tab" aria-selected="false">Preview</button>
+</div>
+<div class="md-toolbar" role="toolbar" aria-label="Formatting">${(0, html_1.joinHtml)(groups)}</div>
+</div>
+<textarea class="${o.codeEditor ? 'code-editor ' : ''}md-input" name="${o.name}"${o.id ? (0, html_1.html) ` id="${o.id}"` : ''} rows="${String(o.rows)}"${o.placeholder ? (0, html_1.html) ` placeholder="${o.placeholder}"` : ''}${o.codeEditor ? (0, html_1.html) ` spellcheck="false"` : ''}>${o.value ?? ''}</textarea>
+<div class="md-render markdown-body" hidden></div>
+</div>`;
+}

package/dist/migrate.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.migrateLayout = migrateLayout;
 exports.migratePermissions = migratePermissions;
+exports.migratePushPolicy = migratePushPolicy;
+const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const layout_1 = require("./layout");
@@ -332,3 +334,49 @@ function migratePermissions(root) {
     (0, vault_1.finishPermsMigration)(root, siteAdmins);
     return notes;
 }
+/**
+ * Unset `receive.denyNonFastForwards` on every repository that still carries
+ * it.
+ *
+ * Repositories created before force pushes were allowed were configured to
+ * refuse any push that moved a branch to a commit that was not a descendant of
+ * where it already was. Nothing overrides that per push, so a vault upgraded
+ * from that era would keep refusing force pushes on its existing repositories
+ * while allowing them on every new one, which is the sort of split nobody could
+ * diagnose from the outside.
+ *
+ * The setting is read from the repository's own config file before git is run,
+ * so a vault whose repositories are all current pays a small read each and
+ * spawns nothing. Deletes are deliberately left refused: see createRepo.
+ */
+function migratePushPolicy(root) {
+    const changed = [];
+    for (const { name: collection } of (0, scan_1.listCollections)(root)) {
+        for (const dirName of (0, scan_1.listRepoDirs)(root, collection)) {
+            const dir = path.join((0, layout_1.collectionsDir)(root), collection, layout_1.REPOS_DIR, dirName);
+            const configFile = path.join(dir, 'config');
+            let text;
+            try {
+                text = fs.readFileSync(configFile, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            if (!/denyNonFastForwards/i.test(text))
+                continue;
+            try {
+                (0, child_process_1.execFileSync)('git', ['-C', dir, 'config', '--unset-all', 'receive.denyNonFastForwards'], {
+                    stdio: 'ignore',
+                });
+                changed.push(`${collection}/${(0, scan_1.displayName)(dirName)}`);
+            }
+            catch {
+                // A repository whose config could not be changed keeps refusing force
+                // pushes, which is the behaviour it has had all along. It is named so
+                // that the operator can unset it by hand.
+                changed.push(`${collection}/${(0, scan_1.displayName)(dirName)} (failed)`);
+            }
+        }
+    }
+    return changed;
+}

package/dist/naming.js

@@ -0,0 +1,25 @@
+"use strict";
+// The spellings that name the product rather than describe the mechanism.
+//
+// Everything here defaults to the mochi spellings, so mochiforge itself is
+// unchanged by this file existing. A sibling application built on these
+// modules (dango is the first) calls setNaming() once, before anything else
+// runs, and the token prefix, session cookie, state file, environment
+// variables, and CLI wording all take its name instead. The values are read
+// at call time, never captured at module load, which is what makes the one
+// early setNaming() call sufficient.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.naming = void 0;
+exports.setNaming = setNaming;
+exports.naming = {
+    product: 'mochi',
+    tokenPrefix: 'mochi_',
+    cookieName: 'mochi_session',
+    stateFile: 'vault.json',
+    rootNoun: 'vault',
+    envPrefix: 'MOCHI',
+    configDirName: 'mochi',
+};
+function setNaming(overrides) {
+    Object.assign(exports.naming, overrides);
+}