npm - @magland/mochi - Versions diffs - 0.3.1 → 0.4.1 - Mend

@magland/mochi 0.3.1 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (83) hide show

package/README.md +7 -6
package/dist/agefile.js +47 -0
package/dist/agescript.js +343 -0
package/dist/api/admin.js +66 -28
package/dist/api/auth.js +3 -2
package/dist/api/backup.js +227 -192
package/dist/api/contents.js +46 -16
package/dist/api/repos.js +60 -4
package/dist/api/write.js +138 -8
package/dist/api.js +34 -1
package/dist/browse.js +171 -33
package/dist/build-info.json +2 -2
package/dist/ci/api.js +138 -4
package/dist/ci/artifacts.js +82 -2
package/dist/ci/engine.js +30 -17
package/dist/ci/expr.js +14 -0
package/dist/ci/runners.js +60 -1
package/dist/ci/runs.js +21 -3
package/dist/ci/trigger.js +6 -4
package/dist/ci/views.js +24 -3
package/dist/ci/web.js +48 -0
package/dist/cli/admin-cmd.js +40 -3
package/dist/cli/backup-cmd.js +166 -120
package/dist/cli/gitrun.js +50 -0
package/dist/cli/pr-cmd.js +155 -0
package/dist/cli/repo-cmd.js +134 -6
package/dist/cli/sync-cmd.js +128 -0
package/dist/cli/target.js +7 -3
package/dist/config.js +10 -0
package/dist/credentials.js +9 -8
package/dist/deploy-cli.js +214 -109
package/dist/deploy-runner-cli.js +125 -49
package/dist/domains.js +259 -0
package/dist/egress.js +23 -6
package/dist/forms.js +703 -32
package/dist/git.js +124 -13
package/dist/githttp.js +80 -23
package/dist/githubauth.js +185 -0
package/dist/icons.js +14 -0
package/dist/import-cli.js +40 -25
package/dist/index.js +110 -4
package/dist/issueweb.js +10 -6
package/dist/lfs.js +9 -2
package/dist/limit.js +2 -2
package/dist/logincodes.js +31 -0
package/dist/maintenance.js +297 -0
package/dist/markdown.js +193 -3
package/dist/mdedit.js +29 -0
package/dist/migrate.js +48 -0
package/dist/naming.js +25 -0
package/dist/onetime.js +112 -0
package/dist/ops.js +293 -16
package/dist/pagescript.js +355 -24
package/dist/perms.js +1 -0
package/dist/profile.js +2 -0
package/dist/pulls.js +21 -1
package/dist/pullweb.js +25 -6
package/dist/releases.js +10 -1
package/dist/runner/actions.js +12 -1
package/dist/runner/client.js +40 -2
package/dist/runner/docker.js +40 -28
package/dist/runner/download.js +77 -0
package/dist/runner/externals.js +12 -1
package/dist/runner/job.js +26 -11
package/dist/runner/steps.js +42 -7
package/dist/runner-cli.js +89 -0
package/dist/scan.js +58 -2
package/dist/server.js +107 -26
package/dist/session.js +82 -40
package/dist/site.js +110 -27
package/dist/sitepublish.js +177 -0
package/dist/sitesettings.js +420 -0
package/dist/siteshost.js +116 -28
package/dist/source.js +20 -0
package/dist/style.js +162 -3
package/dist/topics.js +165 -0
package/dist/vault.js +399 -6
package/dist/vendor-age.js +15 -0
package/dist/views.js +242 -57
package/dist/web.js +11 -1
package/dist/webauthn.js +347 -0
package/dist/webops.js +1263 -33
package/package.json +4 -4

package/dist/pagescript.js CHANGED Viewed

@@ -142,19 +142,48 @@ function findKey(e, input) {
 // and kept for the tab, so typing costs nothing after the first opening.
 var jumpRepos = null;
 var jumpCtx = null;
+var jumpCtxRead = false;
 var jumpSel = 0;
-(function () {
-  var el = document.getElementById('jump-data');
-  if (el) { try { jumpCtx = JSON.parse(el.textContent); } catch (e) {} }
-})();
+// A path on this origin, or null. The context is read out of the page, and
+// a rendered document shares the page; an href that is not a local path is
+// not one the box will send anybody to.
+function localPath(s) {
+  return typeof s === 'string' && s.charAt(0) === '/' && s.charAt(1) !== '/' && s.charAt(1) !== '\\\\' ? s : null;
+}
+// The repository the page is about, read when the box first opens rather than
+// when this file loads: the script is in <head>, so at load time the body,
+// and the element, do not exist yet. The selector names the script tag the
+// template emits (src/views.ts); a rendered document cannot contain one.
+function jumpContext() {
+  if (jumpCtxRead) return jumpCtx;
+  jumpCtxRead = true;
+  var el = document.querySelector('script#jump-data[type="application/json"]');
+  if (!el) return null;
+  var raw;
+  try { raw = JSON.parse(el.textContent); } catch (e) { return null; }
+  if (!raw || typeof raw.repo !== 'string') return null;
+  var sections = [];
+  var list = Array.isArray(raw.sections) ? raw.sections : [];
+  for (var i = 0; i < list.length; i++) {
+    var href = localPath(list[i] && list[i].href);
+    if (href && typeof list[i].label === 'string') sections.push({ label: list[i].label, href: href });
+  }
+  var searchUrl = localPath(raw.searchUrl);
+  var findUrl = localPath(raw.findUrl);
+  if (!searchUrl || !findUrl) return null;
+  jumpCtx = { repo: raw.repo, sections: sections, searchUrl: searchUrl, findUrl: findUrl };
+  return jumpCtx;
+}
 function loadJumpRepos() {
   if (jumpRepos) return Promise.resolve(jumpRepos);
   var cached = null;
-  try { cached = sessionStorage.getItem('mochi.repos'); } catch (e) {}
+  // The key carries a version: the entries grew topics, and a tab holding the
+  // older list of bare names would otherwise feed it to code expecting objects.
+  try { cached = sessionStorage.getItem('mochi.repos.v2'); } catch (e) {}
   if (cached) { try { jumpRepos = JSON.parse(cached); return Promise.resolve(jumpRepos); } catch (e) {} }
   return fetch('/assets/repos.json').then(function (r) { return r.json(); }).then(function (list) {
     jumpRepos = list;
-    try { sessionStorage.setItem('mochi.repos', JSON.stringify(list)); } catch (e) {}
+    try { sessionStorage.setItem('mochi.repos.v2', JSON.stringify(list)); } catch (e) {}
     return list;
   }, function () { jumpRepos = []; return jumpRepos; });
 }
@@ -181,6 +210,7 @@ function jumpScore(hay, q) {
 function jumpItems() {
   var q = document.getElementById('jump-q').value.trim().toLowerCase();
   var out = [];
+  var jumpCtx = jumpContext();
   if (jumpCtx) {
     for (var s = 0; s < jumpCtx.sections.length; s++) {
       var sec = jumpCtx.sections[s];
@@ -190,17 +220,27 @@ function jumpItems() {
   }
   var repos = jumpRepos || [];
   for (var i = 0; i < repos.length; i++) {
-    var name = repos[i];
+    var entry = repos[i];
+    var name = typeof entry === 'string' ? entry : entry.name;
+    var topics = (entry && entry.topics) || [];
     var slash = name.indexOf('/');
     var short = name.slice(slash + 1);
+    var note = name.slice(0, slash);
     var sc = jumpScore(short, q);
     // Falling back to the whole path lets "concept/bench" find a repository,
     // but only as a literal substring: a collection name spread across it a
     // letter at a time would match nearly everything.
     if (sc < 0 && q !== '' && name.toLowerCase().indexOf(q) !== -1) sc = 950;
+    // Last, the topics: typing one finds what carries it, below any match on
+    // a name, and the note says which topic answered.
+    if (sc < 0 && q !== '') {
+      for (var t = 0; t < topics.length; t++) {
+        if (topics[t].indexOf(q) !== -1) { sc = 960; note = note + ' · ' + topics[t]; break; }
+      }
+    }
     // A repository is what the box is mostly for, so its matches sort above a
     // section of equal quality rather than below.
-    if (sc >= 0) out.push({ score: sc - 1, group: 'Repositories', label: short, note: name.slice(0, slash), href: '/' + name.split('/').map(encodeURIComponent).join('/') });
+    if (sc >= 0) out.push({ score: sc - 1, group: 'Repositories', label: short, note: note, href: '/' + name.split('/').map(encodeURIComponent).join('/') });
   }
   out.sort(function (a, b) { return a.score - b.score || a.label.localeCompare(b.label); });
   out = out.slice(0, 15);
@@ -222,7 +262,7 @@ function renderJump() {
     var it = items[i];
     if (it.group !== group) { group = it.group; html += '<li class="jump-group" role="presentation">' + escapeHtml(group) + '</li>'; }
     html += '<li role="option" aria-selected="' + (i === jumpSel) + '"><a class="jump-item' + (i === jumpSel ? ' on' : '') +
-      '" href="' + escapeHtml(it.href) + '" data-jump-index="' + i + '">' + escapeHtml(it.label) +
+      '" href="' + escapeHtml(it.href) + '" data-jump-index="' + i + '"><span class="jump-name">' + escapeHtml(it.label) + '</span>' +
       (it.note ? '<span class="jump-note">' + escapeHtml(it.note) + '</span>' : '') + '</a></li>';
   }
   list.innerHTML = html || '<li class="jump-empty" role="presentation">' +
@@ -267,6 +307,20 @@ document.addEventListener('click', function (e) {
   var dlg = document.getElementById('jump');
   if (dlg && dlg.open && e.target === dlg) dlg.close();
 });
+// Ids inside a rendered document carry a user-content- prefix (see
+// src/markdown.ts), so a link from outside it to /repo#install names an
+// element that is not there under that name. When the fragment finds nothing,
+// the prefixed element is scrolled to instead, on load and on every change.
+function followHash() {
+  var h = location.hash ? String(location.hash).slice(1) : '';
+  if (!h || document.getElementById(h)) return;
+  var name;
+  try { name = decodeURIComponent(h); } catch (e) { name = h; }
+  var el = document.getElementById('user-content-' + name);
+  if (el && el.scrollIntoView) el.scrollIntoView();
+}
+document.addEventListener('DOMContentLoaded', followHash);
+window.addEventListener('hashchange', followHash);
 // The filter box above a listing: hide the rows that do not match, and say so
 // when none do.
 function filterRows(input) {
@@ -314,6 +368,129 @@ function filterMenu(input) {
   }
 }
+// ---- passkeys ----
+//
+// The WebAuthn ceremonies, client half. The server speaks JSON on
+// /login/passkey* and /account/passkeys*, with every binary field base64url,
+// which is also the encoding the WebAuthn API's own ids use. Buttons carry
+// data attributes and start hidden; support is detected here, so a browser
+// without WebAuthn (or a page served over plain http, where the API does not
+// exist) simply never shows them.
+function pkDecode(s) {
+  s = String(s).replace(/-/g, '+').replace(/_/g, '/');
+  while (s.length % 4) s += '=';
+  var bin = atob(s);
+  var out = new Uint8Array(bin.length);
+  for (var i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out.buffer;
+}
+function pkEncode(buf) {
+  var b = new Uint8Array(buf);
+  var bin = '';
+  for (var i = 0; i < b.length; i++) bin += String.fromCharCode(b[i]);
+  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
+}
+function pkSay(message) {
+  var el = document.querySelector('[data-passkey-error]');
+  if (!el) return;
+  el.textContent = message || '';
+  el.hidden = !message;
+}
+function pkFetch(url, body) {
+  return fetch(url, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  }).then(function (r) {
+    return r.json().catch(function () { return {}; }).then(function (d) {
+      if (!r.ok) throw new Error(d.error || ('the server answered ' + r.status));
+      return d;
+    });
+  });
+}
+// A cancelled or timed-out prompt is the user's decision, not a fault to
+// paint red; anything else is said as the server or browser said it.
+function pkProblem(e) {
+  if (e && e.name === 'NotAllowedError') pkSay('Cancelled, or the prompt timed out. Try again when ready.');
+  else pkSay((e && e.message) || 'Something went wrong.');
+}
+function pkRegister(btn) {
+  var form = closestOf(btn, '[data-passkey-form]');
+  var csrf = form.querySelector('input[name=csrf]').value;
+  var label = (form.querySelector('input[name=name]') || { value: '' }).value;
+  pkSay('');
+  btn.disabled = true;
+  pkFetch('/account/passkeys/challenge', { csrf: csrf })
+    .then(function (o) {
+      var publicKey = {
+        challenge: pkDecode(o.challenge),
+        rp: o.rp,
+        user: { id: pkDecode(o.user.id), name: o.user.name, displayName: o.user.displayName },
+        pubKeyCredParams: o.pubKeyCredParams,
+        authenticatorSelection: o.authenticatorSelection,
+        timeout: o.timeout,
+        attestation: o.attestation,
+        excludeCredentials: (o.excludeCredentials || []).map(function (c) {
+          return { type: 'public-key', id: pkDecode(c.id) };
+        }),
+      };
+      return navigator.credentials.create({ publicKey: publicKey });
+    })
+    .then(function (cred) {
+      return pkFetch('/account/passkeys', {
+        csrf: csrf,
+        name: label,
+        id: cred.id,
+        clientDataJSON: pkEncode(cred.response.clientDataJSON),
+        attestationObject: pkEncode(cred.response.attestationObject),
+      });
+    })
+    .then(function (d) { location.href = d.next; })
+    .catch(pkProblem)
+    .then(function () { btn.disabled = false; });
+}
+function pkLogin(btn) {
+  pkSay('');
+  btn.disabled = true;
+  pkFetch('/login/passkey/challenge', {})
+    .then(function (o) {
+      return navigator.credentials.get({
+        publicKey: {
+          challenge: pkDecode(o.challenge),
+          rpId: o.rpId,
+          timeout: o.timeout,
+          userVerification: o.userVerification,
+          allowCredentials: [],
+        },
+      });
+    })
+    .then(function (cred) {
+      return pkFetch('/login/passkey', {
+        next: btn.getAttribute('data-next') || '/',
+        id: cred.id,
+        clientDataJSON: pkEncode(cred.response.clientDataJSON),
+        authenticatorData: pkEncode(cred.response.authenticatorData),
+        signature: pkEncode(cred.response.signature),
+        userHandle: cred.response.userHandle ? pkEncode(cred.response.userHandle) : null,
+      });
+    })
+    .then(function (d) { location.href = d.next; })
+    .catch(pkProblem)
+    .then(function () { btn.disabled = false; });
+}
+document.addEventListener('DOMContentLoaded', function () {
+  var supported = Boolean(window.PublicKeyCredential);
+  var login = document.querySelector('[data-passkey-login]');
+  if (login && supported) login.hidden = false;
+  var add = document.querySelector('[data-passkey-add]');
+  var unsupported = document.querySelector('[data-passkey-unsupported]');
+  if (add && !supported) {
+    add.disabled = true;
+    if (unsupported) unsupported.hidden = false;
+  }
+});
 // ---- wiring ----
 //
 // The markup carries data attributes rather than inline handlers, and the
@@ -346,6 +523,14 @@ document.addEventListener('click', function (e) {
   if (lines) { copyLines(lines); return; }
   var select = closestOf(t, '[data-select-all]');
   if (select) { select.select(); return; }
+  var pkAdd = closestOf(t, '[data-passkey-add]');
+  if (pkAdd) { pkRegister(pkAdd); return; }
+  var pkGo = closestOf(t, '[data-passkey-login-btn]');
+  if (pkGo) { pkLogin(pkGo); return; }
+  var mdTab = closestOf(t, '[data-md-pane]');
+  if (mdTab) { mdPane(mdEditorOf(mdTab), mdTab.getAttribute('data-md-pane')); return; }
+  var mdBtn = closestOf(t, '[data-md-act]');
+  if (mdBtn) { mdAct(mdEditorOf(mdBtn), mdBtn.getAttribute('data-md-act')); return; }
 });
 document.addEventListener('input', function (e) {
@@ -368,6 +553,14 @@ document.addEventListener('keydown', function (e) {
   if (!el || !el.matches) return;
   if (el.id === 'jump-q') { jumpKey(e); return; }
   if (el.matches('.find-input')) { findKey(e, el); return; }
+  // The formatting shortcuts, only inside a markdown editor's field: the same
+  // four GitHub answers to, so hands need not relearn anything.
+  if (el.tagName === 'TEXTAREA' && (e.metaKey || e.ctrlKey) && !e.altKey && !e.shiftKey) {
+    var ed = mdEditorOf(el);
+    if (!ed) return;
+    var act = { b: 'bold', i: 'italic', k: 'link', e: 'code' }[String(e.key).toLowerCase()];
+    if (act) { e.preventDefault(); mdAct(ed, act); }
+  }
 });
 // mouseenter does not bubble, so the jump list is followed with mouseover,
@@ -399,27 +592,165 @@ function pickWorkflow(sel) {
   }
 }
-// The editor: Tab indents rather than leaving the field, since code is what is
-// being typed (Shift-Tab still moves focus out, so the keyboard is not
-// trapped), and navigating away from an edited buffer asks first. Committing
-// does not ask; submitting is the point.
+// ---- the markdown editor ----
+//
+// The toolbar writes markdown into the textarea rather than styling anything:
+// what is stored is what was typed. Every button is a toggle where a toggle
+// makes sense (bold twice is plain again), and the Preview tab shows the draft
+// through the same renderer the saved page will use, fetched from the
+// repository's own preview endpoint so relative links, #12, and commit ids
+// resolve as they will when saved.
+function mdEditorOf(el) { return closestOf(el, '[data-md-editor]'); }
+// Replace [start, end) with text, leave [selStart, selEnd) selected, and keep
+// the field focused so the next keystroke lands where the edit did.
+function mdSet(input, start, end, text, selStart, selEnd) {
+  input.focus();
+  input.setRangeText(text, start, end, 'preserve');
+  input.setSelectionRange(selStart, selEnd);
+}
+// Wrap the selection in the marks, or take them off again when they are
+// already there, inside the selection or just around it.
+function mdSurround(input, before, after, placeholder) {
+  var s = input.selectionStart, e = input.selectionEnd, v = input.value;
+  var sel = v.slice(s, e);
+  if (sel.length >= before.length + after.length &&
+      sel.slice(0, before.length) === before && sel.slice(sel.length - after.length) === after) {
+    var inner = sel.slice(before.length, sel.length - after.length);
+    mdSet(input, s, e, inner, s, s + inner.length);
+    return;
+  }
+  if (s >= before.length && v.slice(s - before.length, s) === before && v.slice(e, e + after.length) === after) {
+    mdSet(input, s - before.length, e + after.length, sel, s - before.length, s - before.length + sel.length);
+    return;
+  }
+  var body = sel || placeholder || '';
+  mdSet(input, s, e, before + body + after, s + before.length, s + before.length + body.length);
+}
+// The whole lines the selection touches, and where they sit in the value.
+function mdLines(input) {
+  var v = input.value;
+  var s = v.lastIndexOf('\\n', input.selectionStart - 1) + 1;
+  var e = v.indexOf('\\n', input.selectionEnd);
+  if (e === -1) e = v.length;
+  return { start: s, end: e, lines: v.slice(s, e).split('\\n') };
+}
+// Prefix each selected line, or strip the prefix when every line has one
+// already; blank lines between prefixed ones are passed over.
+function mdPrefix(input, make, strip) {
+  var r = mdLines(input);
+  var on = r.lines.every(function (l) { return l === '' || strip.test(l); });
+  var out = [];
+  for (var i = 0; i < r.lines.length; i++) {
+    var l = r.lines[i];
+    out.push(on ? l.replace(strip, '') : (l === '' && r.lines.length > 1 ? l : make(i) + l));
+  }
+  var text = out.join('\\n');
+  mdSet(input, r.start, r.end, text, r.start, r.start + text.length);
+}
+// A link: a selected URL becomes the target with the cursor in the text, and
+// anything else becomes the text with the url placeholder selected.
+function mdLink(input) {
+  var s = input.selectionStart, e = input.selectionEnd;
+  var sel = input.value.slice(s, e);
+  if (/^https?:\\/\\/\\S+$/.test(sel)) {
+    mdSet(input, s, e, '[](' + sel + ')', s + 1, s + 1);
+  } else {
+    var body = sel || 'link text';
+    mdSet(input, s, e, '[' + body + '](url)', s + body.length + 3, s + body.length + 6);
+  }
+}
+function mdAct(ed, act) {
+  var input = ed && ed.querySelector('textarea');
+  if (!input || input.hidden) return;
+  if (act === 'bold') return mdSurround(input, '**', '**', 'bold text');
+  if (act === 'italic') return mdSurround(input, '_', '_', 'italic text');
+  if (act === 'strike') return mdSurround(input, '~~', '~~', 'struck text');
+  if (act === 'link') return mdLink(input);
+  if (act === 'code') {
+    var sel = input.value.slice(input.selectionStart, input.selectionEnd);
+    if (sel.indexOf('\\n') !== -1) return mdSurround(input, '\`\`\`\\n', '\\n\`\`\`', '');
+    return mdSurround(input, '\`', '\`', 'code');
+  }
+  if (act === 'heading') return mdPrefix(input, function () { return '### '; }, /^#{1,6} /);
+  if (act === 'quote') return mdPrefix(input, function () { return '> '; }, /^> /);
+  if (act === 'ul') return mdPrefix(input, function () { return '- '; }, /^[-*] (?!\\[[ xX]\\] )/);
+  if (act === 'ol') return mdPrefix(input, function (i) { return (i + 1) + '. '; }, /^\\d+\\. /);
+  if (act === 'task') return mdPrefix(input, function () { return '- [ ] '; }, /^[-*] \\[[ xX]\\] /);
+}
+// The tabs. Write is the field back; Preview posts the draft, with the CSRF
+// value of the form it sits in, and shows what came back. The height of the
+// field is kept so the page does not jump, and an unchanged draft is not
+// posted again.
+function mdPane(ed, pane) {
+  var input = ed.querySelector('textarea');
+  var render = ed.querySelector('.md-render');
+  var tabs = ed.querySelectorAll('[data-md-pane]');
+  for (var i = 0; i < tabs.length; i++) {
+    var on = tabs[i].getAttribute('data-md-pane') === pane;
+    tabs[i].classList[on ? 'add' : 'remove']('current');
+    tabs[i].setAttribute('aria-selected', String(on));
+  }
+  var previewing = pane === 'preview';
+  ed.classList[previewing ? 'add' : 'remove']('previewing');
+  input.hidden = previewing;
+  render.hidden = !previewing;
+  if (!previewing) { input.focus(); return; }
+  render.style.minHeight = input.offsetHeight + 'px';
+  if (ed.mdShown === input.value) return;
+  render.innerHTML = '<p class="muted">Rendering\\u2026</p>';
+  var form = closestOf(ed, 'form');
+  var csrf = form && form.querySelector('input[name=csrf]');
+  var params = new URLSearchParams();
+  params.set('csrf', csrf ? csrf.value : '');
+  params.set('text', input.value);
+  params.set('ref', ed.getAttribute('data-md-ref') || '');
+  params.set('dir', ed.getAttribute('data-md-dir') || '');
+  fetch(ed.getAttribute('data-md-preview'), { method: 'POST', body: params })
+    .then(function (r) { if (!r.ok) throw new Error('preview ' + r.status); return r.text(); })
+    .then(function (h) { ed.mdShown = input.value; render.innerHTML = h; })
+    .catch(function () { render.innerHTML = '<p class="muted">The preview could not be rendered. The draft is untouched.</p>'; });
+}
+// The editors: in one of the code kind, Tab indents rather than leaving the
+// field, since code is what is being typed (Shift-Tab still moves focus out,
+// so the keyboard is not trapped). Navigating away from any edited buffer asks
+// first; committing does not ask, since submitting is the point.
 document.addEventListener('DOMContentLoaded', function () {
-  var ta = document.querySelector('textarea.code-editor');
-  if (!ta) return;
-  var form = ta.closest('form');
-  var initial = ta.value;
+  var tas = document.querySelectorAll('textarea.code-editor, [data-md-editor] textarea');
+  if (!tas.length) return;
+  var initial = [];
   var submitted = false;
-  if (form) form.addEventListener('submit', function () { submitted = true; });
+  function watch(ta) {
+    initial.push(ta.value);
+    var form = ta.closest('form');
+    if (form && !form.mdWatched) {
+      form.mdWatched = true;
+      form.addEventListener('submit', function () { submitted = true; });
+    }
+    if (!ta.classList.contains('code-editor')) return;
+    ta.addEventListener('keydown', function (e) {
+      if (e.key !== 'Tab' || e.shiftKey || e.ctrlKey || e.altKey || e.metaKey) return;
+      e.preventDefault();
+      ta.setRangeText('  ', ta.selectionStart, ta.selectionEnd, 'end');
+    });
+  }
+  for (var i = 0; i < tas.length; i++) watch(tas[i]);
   window.addEventListener('beforeunload', function (e) {
-    if (submitted || ta.value === initial) return;
+    if (submitted) return;
+    var dirty = false;
+    for (var i = 0; i < tas.length; i++) if (tas[i].value !== initial[i]) dirty = true;
+    if (!dirty) return;
     e.preventDefault();
     e.returnValue = '';
   });
-  ta.addEventListener('keydown', function (e) {
-    if (e.key !== 'Tab' || e.shiftKey || e.ctrlKey || e.altKey || e.metaKey) return;
-    e.preventDefault();
-    ta.setRangeText('  ', ta.selectionStart, ta.selectionEnd, 'end');
-  });
 });
 // A live job's log: the endpoint and the offset to resume from are on the

package/dist/perms.js CHANGED Viewed

@@ -44,6 +44,7 @@ exports.collectionOwners = collectionOwners;
 exports.isCollectionOwner = isCollectionOwner;
 exports.addCollectionOwner = addCollectionOwner;
 exports.removeCollectionOwner = removeCollectionOwner;
+exports.tokenIsScoped = tokenIsScoped;
 exports.isSiteAdmin = isSiteAdmin;
 exports.repoRole = repoRole;
 exports.canReadRepo = canReadRepo;

package/dist/profile.js CHANGED Viewed

@@ -5,6 +5,7 @@ exports.collectionProfile = collectionProfile;
 const markdown_1 = require("./markdown");
 const render_1 = require("./render");
 const scan_1 = require("./scan");
+const vault_1 = require("./vault");
 const views_1 = require("./views");
 /**
  * A collection's profile README: the page a collection shows above its
@@ -63,6 +64,7 @@ async function collectionProfile(root, collection) {
             blobBase: `${base}/blob/${(0, views_1.encPath)(branch)}/${exports.PROFILE_DIR}`,
             issueBase: `${base}/issues`,
             commitBase: `${base}/commit`,
+            mentions: (name) => (0, vault_1.userExists)(root, name),
         })
         : `<pre>${(0, render_1.esc)(readme.text)}</pre>`;
     return {

package/dist/pulls.js CHANGED Viewed

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MergeConflict = exports.MAX_TITLE = exports.MAX_BODY = void 0;
+exports.MergeConflict = exports.DuplicatePullError = exports.MAX_TITLE = exports.MAX_BODY = void 0;
 exports.pullsDir = pullsDir;
 exports.listPulls = listPulls;
 exports.pullCounts = pullCounts;
@@ -144,6 +144,20 @@ function readPull(root, collection, repo, n) {
         return null;
     return { ...summaryFrom(n, dir, doc), body: doc.body, commentList: (0, discussion_1.readComments)(dir) };
 }
+/**
+ * A pull request refused because one is already open for the same base and
+ * head. Its own class because the number is what a caller wants: the web
+ * handler sends the reader to the existing pull request rather than
+ * describing it.
+ */
+class DuplicatePullError extends ops_1.OpError {
+    number;
+    constructor(number, head, base) {
+        super(`Pull request #${number} for ${head} into ${base} is already open.`, 'exists');
+        this.number = number;
+    }
+}
+exports.DuplicatePullError = DuplicatePullError;
 function createPull(root, collection, repo, input) {
     const dir = pullsDir(root, collection, repo);
     if (!dir)
@@ -152,6 +166,12 @@ function createPull(root, collection, repo, input) {
     const body = (0, discussion_1.checkBody)(PULL, input.body);
     if (input.base === input.head)
         throw new ops_1.OpError('A branch cannot be merged into itself.');
+    // One open pull request per (base, head): a second would show the same
+    // commits and go stale the moment the first merges. The existing one is
+    // where new discussion belongs, so the refusal carries its number.
+    const open = listPulls(root, collection, repo).find((p) => p.state === 'open' && p.base === input.base && p.head === input.head);
+    if (open)
+        throw new DuplicatePullError(open.number, input.head, input.base);
     const now = new Date().toISOString();
     const n = (0, discussion_1.allocate)(PULL, dir, (sub) => (0, discussion_1.writeDoc)(path.join(sub, 'pull.md'), {
         title,

package/dist/pullweb.js CHANGED Viewed

@@ -41,6 +41,7 @@ const git_1 = require("./git");
 const html_1 = require("./html");
 const icons_1 = require("./icons");
 const markdown_1 = require("./markdown");
+const mdedit_1 = require("./mdedit");
 const ops_1 = require("./ops");
 const pulls = __importStar(require("./pulls"));
 const render_1 = require("./render");
@@ -74,6 +75,7 @@ function body(ctx, text) {
         blobBase: `${base}/blob/${ref}`,
         issueBase: `${base}/issues`,
         commitBase: `${base}/commit`,
+        mentions: ctx.hasUser,
     }));
 }
 function stateBadge(state) {
@@ -101,7 +103,7 @@ function listPage(ctx, list, state, counts) {
     const rows = list.map((p) => (0, html_1.html) `<tr>
 <td class="issue-cell">${stateIcon(p.state)}<span>
 <a class="issue-link" href="${base}/${p.number}">${p.title}</a>
-<div class="muted small">#${p.number} opened ${(0, render_1.timeTag)(p.created)} by ${p.author} &middot; ${branchPair(ctx, p)}</div></span></td>
+<div class="muted small">#${p.number} opened ${(0, render_1.timeTag)(p.created)} by ${(0, views_1.userLink)(p.author)} &middot; ${branchPair(ctx, p)}</div></span></td>
 <td class="right muted small">${p.comments > 0
         ? (0, html_1.html) `<a class="issue-comments" href="${base}/${p.number}" title="${p.comments} comment${p.comments === 1 ? '' : 's'}">${(0, icons_1.icon)('comment')}<span>${p.comments}</span></a>`
         : ''}</td>
@@ -126,7 +128,7 @@ ${rows.length
 }
 function commentCard(author, when, rendered, note = '') {
     return (0, html_1.html) `<article class="issue-comment">
-<div class="issue-comment-head">${(0, avatar_1.avatar)(author, 24)}<b>${author}</b><span class="muted small">${note || 'commented'} ${(0, render_1.timeTag)(when)}</span></div>
+<div class="issue-comment-head">${(0, views_1.userLink)(author, { face: 24, bold: true })}<span class="muted small">${note || 'commented'} ${(0, render_1.timeTag)(when)}</span></div>
 <div class="issue-comment-body markdown-body">${rendered}</div>
 </article>`;
 }
@@ -185,21 +187,23 @@ function pullPage(ctx, pull, view) {
             : '';
         replyBox = (0, html_1.html) `<form class="issue-reply" method="post" action="${base}/${pull.number}/comment">${(0, views_1.csrfField)(viewer)}
 <div class="issue-comment-head">${(0, avatar_1.avatar)(viewer.auth.username, 24)}<b>${viewer.auth.username}</b></div>
-<textarea class="code-editor" name="body" rows="6" placeholder="Leave a comment"></textarea>
+${(0, mdedit_1.markdownEditor)({ name: 'body', rows: 6, placeholder: 'Leave a comment', preview: (0, mdedit_1.previewUrl)(ctx) })}
 <div class="actions">${toggle}<button class="btn btn-primary" type="submit">Comment</button></div>
 </form>`;
     }
     else {
         replyBox = (0, html_1.html) `<p class="muted"><a href="/login?next=${encodeURIComponent(`${base}/${pull.number}`)}">Sign in</a> to comment.</p>`;
     }
-    const commitRows = view.commits.map((c) => (0, html_1.html) `<div class="commit-row"><span class="commit-main"><a class="title" href="${repo}/commit/${c.sha}">${c.subject}</a><div class="muted small">${c.author} committed ${(0, render_1.timeTag)(c.date)}</div></span><a class="sha" href="${repo}/commit/${c.sha}">${c.sha.slice(0, 7)}</a></div>`);
+    const commitRows = view.commits.map((c) => (0, html_1.html) `<div class="commit-row"><span class="commit-main"><a class="title" href="${repo}/commit/${c.sha}">${c.subject}</a><div class="muted small">${(0, views_1.gitAuthor)(ctx, c.author, c.email)} committed ${(0, render_1.timeTag)(c.date)}</div></span><a class="sha" href="${repo}/commit/${c.sha}">${c.sha.slice(0, 7)}</a></div>`);
     const description = body(ctx, pull.body);
     const content = (0, html_1.html) `${(0, views_1.repoHeader)(ctx, 'pulls')}
 <div class="issue-head">
   <h1 class="issue-title">${pull.title} <span class="muted">#${pull.number}</span></h1>
   <span class="right-group"><a class="btn" href="${base}">Back to pull requests</a></span>
 </div>
-<div class="issue-sub">${stateBadge(pull.state)}<span class="muted"><b>${pull.author}</b> wants to merge ${view.ahead} commit${view.ahead === 1 ? '' : 's'} into </span>${branchPair(ctx, pull)}</div>
+<div class="issue-sub">${stateBadge(pull.state)}<span class="muted">${(0, views_1.userLink)(pull.author, {
+        bold: true,
+    })} wants to merge ${view.ahead} commit${view.ahead === 1 ? '' : 's'} into </span>${branchPair(ctx, pull)}</div>
 ${mergeBox(ctx, pull, view.preview, ctx.canPush)}
 <div class="issue-thread">
 ${commentCard(pull.author, pull.created, description.text ? description : (0, html_1.raw)('<p class="muted">No description.</p>'), 'opened this')}
@@ -233,7 +237,15 @@ ${info
 <div class="field"><label for="title">Title</label>
 <input type="text" id="title" name="title" value="${values.title}" maxlength="${pulls.MAX_TITLE}" required autofocus></div>
 <div class="field"><label for="body">Description</label>
-<textarea class="code-editor" id="body" name="body" rows="10" placeholder="What this changes, and why. Markdown is welcome.">${values.body}</textarea></div>
+${(0, mdedit_1.markdownEditor)({
+        name: 'body',
+        id: 'body',
+        rows: 10,
+        placeholder: 'What this changes, and why. Markdown is welcome.',
+        value: values.body,
+        preview: (0, mdedit_1.previewUrl)(ctx),
+        ref: values.head,
+    })}</div>
 <div class="actions"><button class="btn btn-primary" type="submit">${(0, icons_1.icon)('git-pull-request')}<span>Create pull request</span></button><a class="btn" href="${base}">Cancel</a></div>
 </form>
 </div>`;
@@ -319,6 +331,13 @@ function registerPulls(app, root, engine) {
             res.redirect(`${pullsUrl(ctx)}/${created.number}`);
         }
         catch (e) {
+            // A pull request already open for this base and head is where this one
+            // was headed anyway, so the reader is sent there instead of shown a form
+            // error describing it.
+            if (e instanceof pulls.DuplicatePullError) {
+                res.redirect(`${pullsUrl(ctx)}/${e.number}`);
+                return;
+            }
             const message = e instanceof ops_1.OpError ? e.message : 'Could not open the pull request.';
             res
                 .status(400)

package/dist/releases.js CHANGED Viewed

@@ -50,6 +50,7 @@ const git_1 = require("./git");
 const html_1 = require("./html");
 const icons_1 = require("./icons");
 const markdown_1 = require("./markdown");
+const mdedit_1 = require("./mdedit");
 const render_1 = require("./render");
 const session_1 = require("./session");
 const layout_1 = require("./layout");
@@ -257,7 +258,14 @@ ${editing
 <div class="field"><label for="name">Title</label>
 <input type="text" id="name" name="name" maxlength="${MAX_NAME}" value="${editing?.name ?? ''}" placeholder="Leave empty to use the tag name"></div>
 <div class="field"><label for="body">Notes</label>
-<textarea class="code-editor" id="body" name="body" rows="16" placeholder="What changed, and what it means for anyone upgrading. Markdown.">${editing?.body ?? ''}</textarea></div>
+${(0, mdedit_1.markdownEditor)({
+        name: 'body',
+        id: 'body',
+        rows: 16,
+        placeholder: 'What changed, and what it means for anyone upgrading. Markdown.',
+        value: editing?.body ?? '',
+        preview: (0, mdedit_1.previewUrl)(ctx),
+    })}</div>
 <div class="field"><label class="checkbox"><input type="checkbox" name="prerelease" value="1"${editing?.prerelease ? (0, html_1.raw)(' checked') : ''}> This is a pre-release</label></div>
 <div class="actions"><button type="submit" class="btn btn-primary">${editing ? 'Save release' : 'Publish release'}</button><a class="btn" href="${base}/releases">Cancel</a>${del}</div>
 </form>
@@ -430,6 +438,7 @@ ${releaseCard(ctx, release, ref, latest, notesHtml(ctx, release))}`;
             blobBase: `${base}/blob/${(0, views_1.encPath)(release.tag)}`,
             issueBase: `${base}/issues`,
             commitBase: `${base}/commit`,
+            mentions: ctx.hasUser,
         });
     }
 }