@magland/mochi 0.3.1 → 0.4.1

package/dist/cli/backup-cmd.js

@@ -33,16 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.backupCommands = void 0;
+exports.backupCommands = exports.MOCHI_BACKUP = void 0;
 exports.backupsIndexPath = backupsIndexPath;
 exports.knownBackups = knownBackups;
 exports.backupLineFor = backupLineFor;
+exports.makeBackupCommands = makeBackupCommands;
 const child_process_1 = require("child_process");
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const atomic_1 = require("../atomic");
+const naming_1 = require("../naming");
 const scan_1 = require("../scan");
 const exit_1 = require("./exit");
 const output_1 = require("./output");
@@ -275,8 +277,8 @@ function isVaultRelative(p) {
 }
 /** How a refused path is reported, in one place since two kinds of line carry one. */
 function refusedPath(p) {
-    return (`The vault named a path this backup will not write: ${JSON.stringify(p)}. ` +
-        'A manifest path must be relative to the vault and must not climb out of it, so nothing was copied.');
+    return (`The ${naming_1.naming.rootNoun} named a path this backup will not write: ${JSON.stringify(p)}. ` +
+        `A manifest path must be relative to the ${naming_1.naming.rootNoun} and must not climb out of it, so nothing was copied.`);
 }
 async function fetchManifest(target, exclude, hash) {
     const query = [];
@@ -308,8 +310,8 @@ async function fetchManifest(target, exclude, hash) {
         // URL and the token, neither of which is the problem.
         if (resp.status === 404) {
             message =
-                `${target.host} has no /api/backup/manifest route, so it is running a mochi older than this ` +
-                    'command. Deploy the vault again from a version that has it, then run this.';
+                `${target.host} has no /api/backup/manifest route, so it is running a ${naming_1.naming.product} older than this ` +
+                    `command. Deploy the ${naming_1.naming.rootNoun} again from a version that has it, then run this.`;
         }
         // The same status-to-code mapping every other command uses, so that a
         // caller branching on the exit code does not have to learn a second table.
@@ -350,13 +352,13 @@ async function fetchManifest(target, exclude, hash) {
             ended = true;
         }
         else if (kind === 'error') {
-            throw new exit_1.CliError(`The vault could not finish the manifest: ${String(line.error)}`);
+            throw new exit_1.CliError(`The ${naming_1.naming.rootNoun} could not finish the manifest: ${String(line.error)}`);
         }
     }
     // The end line is what says the walk completed. Acting on a truncated
     // manifest would delete every path the vault did not get around to listing.
     if (!ended) {
-        throw new exit_1.CliError('The manifest ended early, so what the vault holds is not fully known. Nothing was deleted; try again.');
+        throw new exit_1.CliError(`The manifest ended early, so what the ${naming_1.naming.rootNoun} holds is not fully known. Nothing was deleted; try again.`);
     }
     return manifest;
 }
@@ -428,7 +430,7 @@ class FrameReader {
         let left = n;
         while (left > 0) {
             if (this.buf.length === 0 && !(await this.more())) {
-                throw new exit_1.CliError('The vault closed the connection part way through a file. Nothing was left half-written.');
+                throw new exit_1.CliError(`The ${naming_1.naming.rootNoun} closed the connection part way through a file. Nothing was left half-written.`);
             }
             const take = Math.min(left, this.buf.length);
             sink(this.buf.subarray(0, take));
@@ -530,6 +532,29 @@ function walkFiles(dir, rel = '', out = []) {
     }
     return out;
 }
+/**
+ * Every directory under dir, as paths relative to it, each after its parent.
+ * Listed apart from the files because an empty directory can matter: a bare
+ * repository whose refs are all packed has an empty refs/, and git does not
+ * take a directory without refs/ for a repository.
+ */
+function walkDirs(dir, rel = '', out = []) {
+    let entries;
+    try {
+        entries = fs.readdirSync(path.join(dir, rel), { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        if (!e.isDirectory())
+            continue;
+        const child = rel ? `${rel}/${e.name}` : e.name;
+        out.push(child);
+        walkDirs(dir, child, out);
+    }
+    return out;
+}
 /**
  * A snapshot of current/ as a directory of hardlinks: one inode per file and no
  * data, and still a servable vault.
@@ -549,11 +574,16 @@ function takeSnapshot(dir, quiet) {
     if (fs.existsSync(to)) {
         throw new exit_1.CliError(`A snapshot named ${name} is already there, so this second is left alone.`, exit_1.EXIT_CONFLICT);
     }
+    const dirs = walkDirs(from);
     const files = walkFiles(from);
     const maxLinks = before + 1;
     fs.mkdirSync(to, { recursive: true });
     let linked = 0;
     try {
+        // Every directory, not only those a file lands in, so that the snapshot has
+        // the empty ones too and its repositories are still repositories.
+        for (const rel of dirs)
+            fs.mkdirSync(path.join(to, rel), { recursive: true });
         for (const rel of files) {
             const src = path.join(from, rel);
             const st = fs.lstatSync(src);
@@ -670,18 +700,58 @@ const RETENTION_OPTIONS = [
         summary: `Monthly snapshots to keep (default ${DEFAULT_RETENTION.monthly})`,
     },
 ];
-const EXCLUDE_OPTIONS = [
-    { name: 'no-runs', type: 'boolean', summary: 'Leave out workflow run history (<repo>.runs)' },
-    { name: 'no-sites', type: 'boolean', summary: 'Leave out published sites (<repo>.site)' },
-    { name: 'no-lfs', type: 'boolean', summary: 'Leave out LFS objects on the volume (<repo>.lfs)' },
-    { name: 'no-secrets', type: 'boolean', summary: 'Leave out vault.json, runners.json, and .secret' },
-];
+exports.MOCHI_BACKUP = {
+    exclusions: [
+        { category: 'runs', summary: 'Leave out workflow run history (<repo>.runs)' },
+        { category: 'sites', summary: 'Leave out published sites (<repo>.site)' },
+        { category: 'lfs', summary: 'Leave out LFS objects on the volume (<repo>.lfs)' },
+        { category: 'secrets', summary: 'Leave out vault.json, runners.json, .secret, and .github-secret' },
+    ],
+    repos: true,
+    description: `A vault is a directory, so a backup of one is a directory too, and this makes it
+over HTTP: it needs no shell on the server, no flyctl, and no rsync at the far
+end, so it works the same against a Fly app, a VPS, a Docker deployment, and
+127.0.0.1:3000.
+
+  <dir>/current      a servable vault. Restoring is: mochi serve <dir>/current
+  <dir>/snapshots    hardlinked copies, each one also a servable vault
+  <dir>/backup.json  which vault, what is left out, and how each run went
+
+Repositories come across as mirrors, so a second run moves only the objects it
+does not have and skips a repository nothing was pushed to. Everything beside
+them - issues, pull requests, releases, sites, run history, LFS objects on the
+volume, and the vault's state files - is compared by size and modification time
+and fetched only where it differs.
+
+The token needs to belong to a site admin, because the copy includes
+vault.json. The vault URL, the exclusions, and the retention policy are recorded
+in backup.json, so a cron entry is this command and a directory.
+
+There is no vault-wide point-in-time image: the server holds no lock a client
+could take, so a run is a walk of a live tree and can catch a mixed vintage.
+Every individual file in a backup is one that really existed. See docs/backup.md.
+
+Related: mochi backup list, verify, prune.`,
+    verifyDescription: `Runs git fsck --connectivity-only over every mirror, asks the vault for hashes,
+and reports anything missing, extra, or different. Exits non-zero when there is
+something to report, so it can be run from cron.`,
+    pruneDescription: `Grandfather-father-son: the newest snapshot of each of the last N days, weeks,
+and months is kept and the rest are removed, evaluated in UTC. The newest
+snapshot is always kept.
+
+A snapshot pins the packfiles that were current when it was taken, so a repack
+in a busy repository leaves the old pack on disk until the last snapshot
+referring to it is pruned. This is what reclaims that space.`,
+};
+function excludeOptions(profile) {
+    return profile.exclusions.map((e) => ({ name: `no-${e.category}`, type: 'boolean', summary: e.summary }));
+}
 const QUIET_OPTION = { name: 'quiet', type: 'boolean', summary: 'Say nothing on success' };
 /** The backup directory a command was given, made if it is not there yet. */
 function backupDirectory(inv, create) {
     const given = inv.args[0];
     if (!given)
-        throw new exit_1.CliError('Which directory? Usage: mochi backup <dir>', exit_1.EXIT_USAGE);
+        throw new exit_1.CliError(`Which directory? Usage: ${naming_1.naming.product} backup <dir>`, exit_1.EXIT_USAGE);
     const dir = path.resolve(given);
     if (!fs.existsSync(dir)) {
         if (!create)
@@ -697,7 +767,7 @@ function backupDirectory(inv, create) {
 function existingBackup(inv) {
     const dir = backupDirectory(inv, false);
     if (!fs.existsSync(statePath(dir))) {
-        throw new exit_1.CliError(`${dir} holds no backup (no ${STATE_FILE}). Make one first: mochi backup ${inv.args[0]}`, exit_1.EXIT_USAGE);
+        throw new exit_1.CliError(`${dir} holds no backup (no ${STATE_FILE}). Make one first: ${naming_1.naming.product} backup ${inv.args[0]}`, exit_1.EXIT_USAGE);
     }
     return { dir, state: loadState(dir) };
 }
@@ -707,16 +777,8 @@ function existingBackup(inv) {
  * last run used, and naming any at all replaces the set, which is how a
  * category can be put back.
  */
-function exclusionsFor(inv, state) {
-    const given = [];
-    if (inv.bool('no-runs'))
-        given.push('runs');
-    if (inv.bool('no-sites'))
-        given.push('sites');
-    if (inv.bool('no-lfs'))
-        given.push('lfs');
-    if (inv.bool('no-secrets'))
-        given.push('secrets');
+function exclusionsFor(inv, state, profile) {
+    const given = profile.exclusions.map((e) => e.category).filter((c) => inv.bool(`no-${c}`));
     return given.length ? given : state.excluded;
 }
 function retentionFor(inv, state) {
@@ -884,14 +946,14 @@ async function fetchChunk(target, current, chunk, state, wantHashes) {
         throw new exit_1.CliError(message, (0, exit_1.exitCodeForStatus)(resp.status));
     }
     if (!resp.body)
-        throw new exit_1.CliError('The vault answered a fetch with no body.');
+        throw new exit_1.CliError(`The ${naming_1.naming.rootNoun} answered a fetch with no body.`);
     const reader = new FrameReader(resp.body);
     let bytes = 0;
     let missing = [];
     for (;;) {
         const line = await reader.line();
         if (line === null)
-            throw new exit_1.CliError('The vault ended a fetch without saying it had finished.');
+            throw new exit_1.CliError(`The ${naming_1.naming.rootNoun} ended a fetch without saying it had finished.`);
         const frame = JSON.parse(line);
         if (frame.end) {
             missing = frame.missing ?? [];
@@ -900,7 +962,7 @@ async function fetchChunk(target, current, chunk, state, wantHashes) {
         const rel = frame.path;
         const size = frame.size;
         if (typeof rel !== 'string' || typeof size !== 'number' || !byPath.has(rel)) {
-            throw new exit_1.CliError(`The vault sent a file this run did not ask for: ${String(rel)}`);
+            throw new exit_1.CliError(`The ${naming_1.naming.rootNoun} sent a file this run did not ask for: ${String(rel)}`);
         }
         const wanted = byPath.get(rel);
         const dest = path.join(current, ...rel.split('/'));
@@ -993,7 +1055,7 @@ function emptyDirs(dir, rel = '', out = []) {
     }
     return empty;
 }
-async function syncCmd(inv) {
+async function syncCmd(inv, profile) {
     const json = (0, output_1.jsonMode)(inv);
     // Two kinds of silence, and they are not the same. --json puts one JSON value
     // on stdout, so the running commentary has to go, but a warning is a
@@ -1004,7 +1066,7 @@ async function syncCmd(inv) {
     const dir = backupDirectory(inv, true);
     const state = loadState(dir);
     const target = await targetForBackup(inv, state);
-    const exclude = exclusionsFor(inv, state);
+    const exclude = exclusionsFor(inv, state, profile);
     const retention = retentionFor(inv, state);
     const checksum = inv.bool('checksum');
     const current = path.join(dir, CURRENT);
@@ -1078,7 +1140,7 @@ async function syncCmd(inv) {
             delete state.repos[known];
             summary.repos.removed++;
             if (!quiet)
-                console.error(`Removed ${known}, which the vault no longer holds`);
+                console.error(`Removed ${known}, which the ${naming_1.naming.rootNoun} no longer holds`);
         }
         // Files.
         const changed = [];
@@ -1094,7 +1156,7 @@ async function syncCmd(inv) {
             for (const gone of r.missing) {
                 delete state.files[gone];
                 if (!quiet)
-                    console.error(`${gone} vanished from the vault while this run was reading it`);
+                    console.error(`${gone} vanished from the ${naming_1.naming.rootNoun} while this run was reading it`);
             }
         }
         // A mirror's config is one of the files the manifest names, so the copy just
@@ -1204,15 +1266,17 @@ async function syncCmd(inv) {
     if (quiet)
         return;
     const r = summary.repos;
-    console.log(`${r.total} repositories: ${r.cloned} cloned, ${r.fetched} fetched, ${r.skipped} unchanged` +
-        (r.removed ? `, ${r.removed} removed` : ''));
+    if (profile.repos) {
+        console.log(`${r.total} repositories: ${r.cloned} cloned, ${r.fetched} fetched, ${r.skipped} unchanged` +
+            (r.removed ? `, ${r.removed} removed` : ''));
+    }
     console.log(`${summary.files.total} files: ${summary.files.fetched} fetched (${human(summary.files.bytes)})` +
         (summary.files.removed ? `, ${summary.files.removed} removed` : ''));
     if (summary.snapshot)
         console.log(`Snapshot ${summary.snapshot}`);
     console.log('');
-    console.log(`Serve this backup to look at it, or to stand the vault back up:`);
-    console.log(`  mochi serve ${path.join(dir, CURRENT)}`);
+    console.log(`Serve this backup to look at it, or to stand the ${naming_1.naming.rootNoun} back up:`);
+    console.log(`  ${naming_1.naming.product} serve ${path.join(dir, CURRENT)}`);
 }
 // ---- list, prune, verify ----
 function listCmd(inv) {
@@ -1236,7 +1300,7 @@ function listCmd(inv) {
         return;
     }
     console.log(`${dir}`);
-    console.log(`  vault      ${state.host || '(unknown)'}`);
+    console.log(`  ${naming_1.naming.rootNoun.padEnd(10)} ${state.host || '(unknown)'}`);
     console.log(`  current    ${human(apparentSize(path.join(dir, CURRENT)))} apparent`);
     console.log(`  excluded   ${state.excluded.length ? state.excluded.join(', ') : 'nothing'}`);
     console.log(`  retention  ${state.retention.daily} daily, ${state.retention.weekly} weekly, ${state.retention.monthly} monthly`);
@@ -1246,7 +1310,7 @@ function listCmd(inv) {
     }
     console.log('');
     if (snapshots.length === 0) {
-        console.log('No snapshots. `mochi backup <dir> --snapshot` takes one after a sync.');
+        console.log(`No snapshots. '${naming_1.naming.product} backup <dir> --snapshot' takes one after a sync.`);
         return;
     }
     // Apparent size rather than disk use: a snapshot is hardlinked, so what it
@@ -1277,7 +1341,7 @@ function pruneCmd(inv) {
     console.log(dropped.length ? `Pruned ${dropped.length}: ${dropped.join(', ')}` : 'Nothing to prune under this retention.');
     console.log(`${kept.length} snapshot${kept.length === 1 ? '' : 's'} kept.`);
 }
-async function verifyCmd(inv) {
+async function verifyCmd(inv, profile) {
     const { dir, state } = existingBackup(inv);
     const json = (0, output_1.jsonMode)(inv);
     const quiet = inv.bool('quiet') || json.enabled;
@@ -1304,7 +1368,7 @@ async function verifyCmd(inv) {
     // The files, against hashes the vault computes now. This is the part a
     // size-and-mtime sync cannot check on its own.
     if (!quiet)
-        console.error('Asking the vault for hashes');
+        console.error(`Asking the ${naming_1.naming.rootNoun} for hashes`);
     const manifest = await fetchManifest(target, state.excluded, true);
     for (const f of manifest.files.values()) {
         const dest = path.join(current, ...f.path.split('/'));
@@ -1317,11 +1381,11 @@ async function verifyCmd(inv) {
             continue;
         }
         if (st.size !== f.size) {
-            problems.push({ path: f.path, problem: `size ${st.size}, the vault has ${f.size}` });
+            problems.push({ path: f.path, problem: `size ${st.size}, the ${naming_1.naming.rootNoun} has ${f.size}` });
             continue;
         }
         if (f.sha256 && sha256Of(dest) !== f.sha256) {
-            problems.push({ path: f.path, problem: 'contents differ from the vault' });
+            problems.push({ path: f.path, problem: `contents differ from the ${naming_1.naming.rootNoun}` });
         }
     }
     const mirrors = repos.map((p) => p.split('/').join(path.sep));
@@ -1331,11 +1395,11 @@ async function verifyCmd(inv) {
         if (insideMirror(asPath))
             continue;
         if (!manifest.files.has(rel))
-            problems.push({ path: rel, problem: 'in the backup, not in the vault' });
+            problems.push({ path: rel, problem: `in the backup, not in the ${naming_1.naming.rootNoun}` });
     }
     for (const entry of manifest.repos) {
         if (!state.repos[entry.path])
-            problems.push({ path: entry.path, problem: 'in the vault, not in the backup' });
+            problems.push({ path: entry.path, problem: `in the ${naming_1.naming.rootNoun}, not in the backup` });
     }
     // The hardlink invariant the snapshots rest on. A file with more links than
     // current/ plus the snapshots can account for is shared with something
@@ -1356,7 +1420,9 @@ async function verifyCmd(inv) {
     }
     else if (problems.length === 0) {
         if (!inv.bool('quiet')) {
-            console.log(`${repos.length} mirrors and ${manifest.files.size} files check out against ${target.host}.`);
+            console.log(profile.repos
+                ? `${repos.length} mirrors and ${manifest.files.size} files check out against ${target.host}.`
+                : `${manifest.files.size} files check out against ${target.host}.`);
         }
     }
     else {
@@ -1378,7 +1444,7 @@ async function verifyCmd(inv) {
  */
 function backupsIndexPath() {
     const base = process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config');
-    return path.join(base, 'mochi', 'backups.json');
+    return path.join(base, naming_1.naming.configDirName, 'backups.json');
 }
 function knownBackups() {
     try {
@@ -1424,77 +1490,57 @@ function backupLineFor(hosts) {
 }
 // ---- the commands ----
 const COMMON = [output_1.JSON_OPTION, QUIET_OPTION, ...target_1.TARGET_OPTIONS];
-exports.backupCommands = [
-    {
-        path: ['backup'],
-        summary: 'Copy a whole vault to a directory on this machine, incrementally',
-        description: `A vault is a directory, so a backup of one is a directory too, and this makes it
-over HTTP: it needs no shell on the server, no flyctl, and no rsync at the far
-end, so it works the same against a Fly app, a VPS, a Docker deployment, and
-127.0.0.1:3000.
-
-  <dir>/current      a servable vault. Restoring is: mochi serve <dir>/current
-  <dir>/snapshots    hardlinked copies, each one also a servable vault
-  <dir>/backup.json  which vault, what is left out, and how each run went
-
-Repositories come across as mirrors, so a second run moves only the objects it
-does not have and skips a repository nothing was pushed to. Everything beside
-them - issues, pull requests, releases, sites, run history, LFS objects on the
-volume, and the vault's state files - is compared by size and modification time
-and fetched only where it differs.
-
-The token needs to belong to a site admin, because the copy includes
-vault.json. The vault URL, the exclusions, and the retention policy are recorded
-in backup.json, so a cron entry is this command and a directory.
-
-There is no vault-wide point-in-time image: the server holds no lock a client
-could take, so a run is a walk of a live tree and can catch a mixed vintage.
-Every individual file in a backup is one that really existed. See docs/backup.md.
-
-Related: mochi backup list, verify, prune.`,
-        args: [{ name: 'dir', required: true }],
-        options: [
-            { name: 'snapshot', type: 'boolean', summary: 'Take a snapshot after a successful sync, then prune' },
-            ...RETENTION_OPTIONS,
-            ...EXCLUDE_OPTIONS,
-            { name: 'checksum', type: 'boolean', summary: 'Compare hashes rather than size and modification time' },
-            ...COMMON,
-        ],
-        async run(inv) {
-            await syncCmd(inv);
-            const dir = path.resolve(inv.args[0]);
-            rememberBackup(dir, loadState(dir).host);
+/**
+ * The backup commands for one application. Mochi's are `backupCommands`
+ * below; a sibling application built on these modules (dango) passes its own
+ * profile and gets the same four commands with its own exclusions and help.
+ */
+function makeBackupCommands(profile) {
+    const noun = naming_1.naming.rootNoun;
+    return [
+        {
+            path: ['backup'],
+            summary: `Copy a whole ${noun} to a directory on this machine, incrementally`,
+            description: profile.description,
+            args: [{ name: 'dir', required: true }],
+            options: [
+                { name: 'snapshot', type: 'boolean', summary: 'Take a snapshot after a successful sync, then prune' },
+                ...RETENTION_OPTIONS,
+                ...excludeOptions(profile),
+                { name: 'checksum', type: 'boolean', summary: 'Compare hashes rather than size and modification time' },
+                ...COMMON,
+            ],
+            async run(inv) {
+                await syncCmd(inv, profile);
+                const dir = path.resolve(inv.args[0]);
+                rememberBackup(dir, loadState(dir).host);
+            },
         },
-    },
-    {
-        path: ['backup', 'list'],
-        summary: "Show a backup's snapshots, and how the last run went",
-        args: [{ name: 'dir', required: true }],
-        options: [output_1.JSON_OPTION],
-        run: listCmd,
-    },
-    {
-        path: ['backup', 'verify'],
-        summary: 'Check a backup against the vault, and its mirrors against git',
-        description: `Runs git fsck --connectivity-only over every mirror, asks the vault for hashes,
-and reports anything missing, extra, or different. Exits non-zero when there is
-something to report, so it can be run from cron.`,
-        args: [{ name: 'dir', required: true }],
-        options: [...COMMON],
-        run: verifyCmd,
-    },
-    {
-        path: ['backup', 'prune'],
-        summary: 'Apply the retention policy to the snapshots, without syncing',
-        description: `Grandfather-father-son: the newest snapshot of each of the last N days, weeks,
-and months is kept and the rest are removed, evaluated in UTC. The newest
-snapshot is always kept.
-
-A snapshot pins the packfiles that were current when it was taken, so a repack
-in a busy repository leaves the old pack on disk until the last snapshot
-referring to it is pruned. This is what reclaims that space.`,
-        args: [{ name: 'dir', required: true }],
-        options: [...RETENTION_OPTIONS, output_1.JSON_OPTION, QUIET_OPTION],
-        run: pruneCmd,
-    },
-];
+        {
+            path: ['backup', 'list'],
+            summary: "Show a backup's snapshots, and how the last run went",
+            args: [{ name: 'dir', required: true }],
+            options: [output_1.JSON_OPTION],
+            run: listCmd,
+        },
+        {
+            path: ['backup', 'verify'],
+            summary: profile.repos
+                ? `Check a backup against the ${noun}, and its mirrors against git`
+                : `Check a backup against the ${noun}`,
+            description: profile.verifyDescription,
+            args: [{ name: 'dir', required: true }],
+            options: [...COMMON],
+            run: (inv) => verifyCmd(inv, profile),
+        },
+        {
+            path: ['backup', 'prune'],
+            summary: 'Apply the retention policy to the snapshots, without syncing',
+            description: profile.pruneDescription,
+            args: [{ name: 'dir', required: true }],
+            options: [...RETENTION_OPTIONS, output_1.JSON_OPTION, QUIET_OPTION],
+            run: pruneCmd,
+        },
+    ];
+}
+exports.backupCommands = makeBackupCommands(exports.MOCHI_BACKUP);

package/dist/cli/gitrun.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+exports.capture = capture;
+exports.mochiCredentialEnv = mochiCredentialEnv;
+exports.mochiCredentialArgs = mochiCredentialArgs;
+exports.ghCredentialArgs = ghCredentialArgs;
+const child_process_1 = require("child_process");
+// Client-side git, shared by the commands that move repositories between a
+// vault and somewhere else: `mochi import` and `mochi fork` (clone from a
+// source, push to the vault), `mochi sync` (fetch from an upstream, push to
+// the vault), and `mochi pr export` (clone from the vault, push to GitHub).
+// All of them run on the operator's machine, which is the point: the vault
+// holds no credential for any system but itself.
+/** Run a command with its output going straight to the terminal, so a long clone shows progress. */
+function run(cmd, args, env) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(cmd, args, { stdio: 'inherit', env: env ?? process.env });
+        child.on('error', (e) => reject(new Error(e.code === 'ENOENT' ? `${cmd} is not on PATH` : String(e.message))));
+        child.on('close', (code) => resolve(code ?? 1));
+    });
+}
+/** Run a command quietly and capture its stdout, or null when it fails to run or exits nonzero. */
+function capture(cmd, args, env) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)(cmd, args, { maxBuffer: 4 * 1024 * 1024, env: env ?? process.env }, (err, stdout) => {
+            resolve(err ? null : String(stdout));
+        });
+    });
+}
+// The token is handed to git through a helper that reads it from the
+// environment rather than through the command line, where every process on the
+// machine could read it. The empty helper first clears the list, so the answer
+// comes from here and nowhere else, and no prompt can appear.
+function mochiCredentialEnv(username, token) {
+    return { ...process.env, MOCHI_USER: username, MOCHI_TOKEN: token, GIT_TERMINAL_PROMPT: '0' };
+}
+const MOCHI_CREDENTIAL_HELPER = `!f() { test "$1" = get && printf 'username=%s\\npassword=%s\\n' "$MOCHI_USER" "$MOCHI_TOKEN"; }; f`;
+/** git options that make a vault URL authenticate from mochiCredentialEnv and nothing else. */
+function mochiCredentialArgs() {
+    return ['-c', 'credential.helper=', '-c', `credential.helper=${MOCHI_CREDENTIAL_HELPER}`];
+}
+/**
+ * git options that make a github.com URL authenticate through `gh`'s own
+ * credential helper. `pr export` pushes with these, so having run
+ * `gh auth login` once is the only GitHub credential setup it asks for.
+ */
+function ghCredentialArgs() {
+    return ['-c', 'credential.helper=', '-c', 'credential.helper=!gh auth git-credential'];
+}