@magland/mochi 0.3.1 → 0.4.1

package/dist/cli/pr-cmd.js

@@ -1,7 +1,45 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.prCommands = void 0;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const cli_api_1 = require("../cli-api");
+const source_1 = require("../source");
+const gitrun_1 = require("./gitrun");
 const exit_1 = require("./exit");
 const input_1 = require("./input");
 const output_1 = require("./output");
@@ -266,6 +304,123 @@ commit. That is what this reports, and it is worth knowing that is what it means
             (0, output_1.printTable)(matching.map((r) => [`#${r.number}`, String(r.status), String(r.conclusion ?? ''), String(r.workflowName ?? r.workflow ?? '')]));
         },
     },
+    {
+        path: ['pr', 'export'],
+        summary: 'Send a pull request on to the GitHub repository this one was forked from',
+        description: `The repository must have a GitHub upstream recorded (mochi fork records one;
+mochi repo edit --upstream sets one). The pull request's head branch is pushed
+to a fork under your GitHub account, made with gh if it does not exist yet,
+and a pull request with the same title and body is opened against the
+upstream. Running it again force-pushes the branch and finds the pull request
+already open rather than opening a second one.
+
+GitHub is only ever touched from this machine, through gh's own credentials:
+the vault holds no GitHub token, so run gh auth login once first.`,
+        args: [{ name: 'number', required: true }],
+        options: [
+            { name: 'base', type: 'string', value: '<b>', summary: 'Base branch on GitHub (default: the pull request base)' },
+            { name: 'fork', type: 'string', value: '<o/r>', summary: 'Your GitHub fork (default: <your login>/<upstream name>)' },
+            ...COMMON,
+        ],
+        async run(inv) {
+            const target = await (0, target_1.targetFrom)(inv);
+            const ref = await (0, repo_1.resolveRepo)(inv, target);
+            const n = pullRef(inv);
+            const pull = await (0, cli_api_1.api)(target, 'GET', `${(0, repo_1.repoPath)(ref)}/pulls/${n}`);
+            if (pull.state !== 'open') {
+                throw new exit_1.CliError(`Pull request #${n} is ${pull.state}; only an open one can be exported.`, exit_1.EXIT_USAGE);
+            }
+            const head = String(pull.head ?? '');
+            const repoData = await (0, cli_api_1.api)(target, 'GET', (0, repo_1.repoPath)(ref));
+            const upstream = (0, source_1.parseUpstream)(String(repoData.upstream ?? ''));
+            if (!upstream?.github) {
+                throw new exit_1.CliError(`${ref.collection}/${ref.repo} has no GitHub upstream recorded, so there is nowhere to send this.\n` +
+                    `Fork with mochi fork, or record one:\n` +
+                    `  mochi repo edit ${ref.collection}/${ref.repo} --upstream https://github.com/owner/repo`, exit_1.EXIT_USAGE);
+            }
+            const gh = upstream.github;
+            const login = (await (0, gitrun_1.capture)('gh', ['api', 'user', '--jq', '.login']))?.trim();
+            if (!login) {
+                throw new exit_1.CliError('GitHub is reached through gh, which is not installed or not logged in. Run: gh auth login', exit_1.EXIT_FAIL);
+            }
+            const forkSpec = inv.str('fork') ?? `${login}/${gh.repo}`;
+            if (!/^[^/\s]+\/[^/\s]+$/.test(forkSpec)) {
+                throw new exit_1.CliError(`--fork should be <owner>/<repo>, not '${forkSpec}'`, exit_1.EXIT_USAGE);
+            }
+            // The head branch has to live on GitHub for GitHub to accept it, so a
+            // fork under your account is the unavoidable middle step. It is a
+            // publishing mirror: it holds the branches you have exported and nothing
+            // else, and gh creates it the first time.
+            if ((await (0, gitrun_1.capture)('gh', ['repo', 'view', forkSpec, '--json', 'name'])) === null) {
+                if (inv.str('fork') !== null) {
+                    throw new exit_1.CliError(`${forkSpec} was not found on GitHub.`, exit_1.EXIT_FAIL);
+                }
+                console.log(`Forking ${gh.owner}/${gh.repo} on GitHub`);
+                if ((await (0, gitrun_1.run)('gh', ['repo', 'fork', `${gh.owner}/${gh.repo}`, '--clone=false'])) !== 0) {
+                    throw new exit_1.CliError(`Could not fork ${gh.owner}/${gh.repo} on GitHub.`, exit_1.EXIT_FAIL);
+                }
+            }
+            const vaultUrl = `${target.host}/${encodeURIComponent(ref.collection)}/${encodeURIComponent(ref.repo)}`;
+            const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'mochi-export-'));
+            try {
+                console.log(`Fetching ${ref.collection}/${ref.repo} @ ${head}`);
+                const env = (0, gitrun_1.mochiCredentialEnv)('mochi', target.token);
+                if ((await (0, gitrun_1.run)('git', [...(0, gitrun_1.mochiCredentialArgs)(), 'clone', '--bare', '--quiet', '--single-branch', '--branch', head, vaultUrl, tmp], env)) !== 0) {
+                    throw new exit_1.CliError(`Could not fetch branch ${head} from ${vaultUrl}.`, exit_1.EXIT_FAIL);
+                }
+                // Forced, deliberately: the branch on the fork exists only as this
+                // pull request's published copy, and a re-export after a rebase in
+                // the vault must win.
+                console.log(`Pushing ${head} to ${forkSpec}`);
+                if ((await (0, gitrun_1.run)('git', ['-C', tmp, ...(0, gitrun_1.ghCredentialArgs)(), 'push', '--quiet', '--force', `https://github.com/${forkSpec}.git`, `refs/heads/${head}:refs/heads/${head}`])) !== 0) {
+                    throw new exit_1.CliError(`Could not push ${head} to ${forkSpec}.`, exit_1.EXIT_FAIL);
+                }
+            }
+            finally {
+                try {
+                    fs.rmSync(tmp, { recursive: true, force: true });
+                }
+                catch {
+                    // A leftover temporary directory is not worth failing the export over.
+                }
+            }
+            const ghHead = `${forkSpec.split('/')[0]}:${head}`;
+            const findExisting = async () => {
+                const out = await (0, gitrun_1.capture)('gh', ['pr', 'list', '--repo', `${gh.owner}/${gh.repo}`, '--head', ghHead, '--state', 'open', '--json', 'url']);
+                if (out === null)
+                    return null;
+                try {
+                    const arr = JSON.parse(out);
+                    return arr.length ? String(arr[0].url ?? '') || null : null;
+                }
+                catch {
+                    return null;
+                }
+            };
+            const existing = await findExisting();
+            if (existing) {
+                console.log(`Updated the branch behind the pull request already open: ${existing}`);
+                return;
+            }
+            const base = inv.str('base') ?? String(pull.base ?? '');
+            const body = `${String(pull.body ?? '').trim()}\n\n---\n\nExported from ${vaultUrl}/pulls/${n}\n`;
+            const bodyFile = path.join(os.tmpdir(), `mochi-export-body-${process.pid}.md`);
+            fs.writeFileSync(bodyFile, body);
+            try {
+                if ((await (0, gitrun_1.run)('gh', ['pr', 'create', '--repo', `${gh.owner}/${gh.repo}`, '--base', base, '--head', ghHead, '--title', String(pull.title ?? `Pull request ${n}`), '--body-file', bodyFile])) !== 0) {
+                    throw new exit_1.CliError(`gh could not open the pull request on ${gh.owner}/${gh.repo}.`, exit_1.EXIT_FAIL);
+                }
+            }
+            finally {
+                fs.rmSync(bodyFile, { force: true });
+            }
+            // Close the loop in the vault: the mochi pull request says where it went.
+            const url = await findExisting();
+            if (url) {
+                await (0, cli_api_1.apiTry)(target, 'POST', `${(0, repo_1.repoPath)(ref)}/pulls/${n}/comments`, { body: `Exported to ${url}` });
+            }
+        },
+    },
     ...['close', 'reopen'].map((verb) => ({
         path: ['pr', verb],
         summary: verb === 'close' ? 'Close a pull request without merging it' : 'Reopen a closed pull request',

package/dist/cli/repo-cmd.js

@@ -30,6 +30,18 @@ function requireYes(inv, what) {
     if (!inv.bool('yes'))
         throw new exit_1.CliError(`${what} cannot be undone. Pass --yes to go ahead.`, exit_1.EXIT_USAGE);
 }
+// One line about the site for `repo view`: off, or where it is served, with
+// the source when it is workflow deploys, since that is the half a reader
+// cannot guess.
+function siteSummary(data) {
+    const site = data.site;
+    if (!site)
+        return data.hasSite ? 'yes' : 'no';
+    if (!site.enabled)
+        return 'off';
+    const source = site.source === 'actions' ? ', deployed by workflows' : site.source === 'repository' ? ', published from the repository' : '';
+    return `${site.url ?? 'on'}${source}`;
+}
 function refQuery(ref, extra = {}) {
     const q = new URLSearchParams(extra);
     if (ref !== null)
@@ -42,10 +54,15 @@ exports.repoCommands = [
         path: ['repo', 'list'],
         summary: 'List the repositories in the vault',
         args: [{ name: 'collection' }],
-        options: [output_1.JSON_OPTION, ...target_1.TARGET_OPTIONS],
+        options: [
+            { name: 'topic', type: 'string', value: '<t>', summary: 'Only repositories carrying this topic' },
+            output_1.JSON_OPTION,
+            ...target_1.TARGET_OPTIONS,
+        ],
         async run(inv) {
             const target = await (0, target_1.targetFrom)(inv);
-            const data = await (0, cli_api_1.api)(target, 'GET', '/api/repos');
+            const topic = inv.str('topic');
+            const data = await (0, cli_api_1.api)(target, 'GET', `/api/repos${topic !== null ? `?topic=${encodeURIComponent(topic)}` : ''}`);
             const only = inv.args[0] ?? null;
             const repos = (data.repos ?? []).filter((r) => only === null || r.collection === only);
             const json = (0, output_1.jsonMode)(inv);
@@ -84,8 +101,12 @@ exports.repoCommands = [
                 const from = data.forkedFrom;
                 console.log(`forked from ${from.collection}/${from.repo}`);
             }
+            if (data.upstream)
+                console.log(`forked from ${data.upstream}`);
+            const topics = (data.topics ?? []);
             (0, output_1.printTable)([
                 ['visibility', data.private ? 'private' : 'public'],
+                ...(topics.length ? [['topics', topics.join(', ')]] : []),
                 ['default branch', String(data.defaultBranch ?? '(none)')],
                 ['last updated', (0, output_1.shortDate)(data.updated)],
                 ['branches', String(data.branches)],
@@ -93,7 +114,7 @@ exports.repoCommands = [
                 ['releases', String(data.releases)],
                 ['open issues', String(data.openIssues)],
                 ['open pull requests', String(data.openPulls)],
-                ['site', data.hasSite ? 'yes' : 'no'],
+                ['site', siteSummary(data)],
             ]);
         },
     },
@@ -155,32 +176,98 @@ exports.repoCommands = [
     },
     {
         path: ['repo', 'edit'],
-        summary: 'Change a repository description, default branch, or visibility',
+        summary: 'Change a repository description, topics, default branch, visibility, or site settings',
+        description: `--topic replaces the whole set, which is what the API does; --add-topic and
+--remove-topic keep what is there and change it, which means reading the
+repository first. A topic is lowercase letters, digits, and hyphens.
+
+The site settings take the admin role. --enable-site serves the repository's
+<repo>.site directory; --site-source actions additionally lets a workflow's
+deploy-pages step publish it, and --site-source repository has the server
+publish the default branch itself on every push (--site-path picks a
+directory within it, such as docs; '' is the root). --site-label picks the label under the vault's
+sites host ('' goes back to the derived <repo>--<alias>, where the alias stands
+in for the collection's name), and --site-domain attaches a custom domain,
+which takes a site admin ('' detaches it). A label another repository holds, or
+one the vault reserves for its operator, is refused.`,
         args: [{ name: 'repo' }],
         options: [
             { name: 'description', type: 'string', value: '<d>', summary: 'New description' },
+            { name: 'topic', type: 'string[]', value: '<t>', summary: 'Replace the topics with these' },
+            { name: 'add-topic', type: 'string[]', value: '<t>', summary: 'Keep the existing topics and add these' },
+            { name: 'remove-topic', type: 'string[]', value: '<t>', summary: 'Keep the existing topics apart from these' },
+            { name: 'clear-topics', type: 'boolean', summary: 'Remove every topic' },
             { name: 'default-branch', type: 'string', value: '<b>', summary: 'New default branch' },
+            { name: 'upstream', type: 'string', value: '<url>', summary: "URL this was forked from; '' clears it" },
             { name: 'private', type: 'boolean', summary: 'Make the repository private (takes the admin role)' },
             { name: 'public', type: 'boolean', summary: 'Make the repository public' },
+            { name: 'enable-site', type: 'boolean', summary: 'Serve the repository site (takes the admin role)' },
+            { name: 'disable-site', type: 'boolean', summary: 'Stop serving the site; its files stay on disk' },
+            { name: 'site-source', type: 'string', value: '<s>', summary: "How the site is published: 'copy', 'actions', or 'repository'" },
+            { name: 'site-path', type: 'string', value: '<dir>', summary: "Directory published by a 'repository' site; '' for the root" },
+            { name: 'site-label', type: 'string', value: '<l>', summary: "Label under the sites host; '' for the default" },
+            { name: 'site-domain', type: 'string', value: '<h>', summary: "Custom domain (site admin); '' detaches it" },
             output_1.JSON_OPTION,
             ...COMMON,
         ],
         async run(inv) {
             const description = inv.str('description');
             const defaultBranch = inv.str('default-branch');
+            const upstream = inv.str('upstream');
             if (inv.bool('private') && inv.bool('public')) {
                 throw new exit_1.CliError('Pass --private or --public, not both.', exit_1.EXIT_USAGE);
             }
             const priv = inv.bool('private') ? true : inv.bool('public') ? false : undefined;
-            if (description === null && defaultBranch === null && priv === undefined) {
-                throw new exit_1.CliError('Nothing to change. Pass --description, --default-branch, --private, or --public.', exit_1.EXIT_USAGE);
+            if (inv.bool('enable-site') && inv.bool('disable-site')) {
+                throw new exit_1.CliError('Pass --enable-site or --disable-site, not both.', exit_1.EXIT_USAGE);
+            }
+            const siteEnabled = inv.bool('enable-site') ? true : inv.bool('disable-site') ? false : undefined;
+            const siteSource = inv.str('site-source');
+            if (siteSource !== null && siteSource !== 'copy' && siteSource !== 'actions' && siteSource !== 'repository') {
+                throw new exit_1.CliError("--site-source takes 'copy', 'actions', or 'repository'.", exit_1.EXIT_USAGE);
+            }
+            const sitePath = inv.str('site-path');
+            const siteLabel = inv.str('site-label');
+            const siteDomain = inv.str('site-domain');
+            const set = inv.list('topic');
+            const add = inv.list('add-topic');
+            const remove = inv.list('remove-topic');
+            const clear = inv.bool('clear-topics');
+            // --topic and --clear-topics each name the whole set, so they combine
+            // with nothing; --add-topic and --remove-topic edit it and may combine.
+            if ((set.length !== 0 ? 1 : 0) + (clear ? 1 : 0) + (add.length !== 0 || remove.length !== 0 ? 1 : 0) > 1) {
+                throw new exit_1.CliError('Pass --topic or --clear-topics on their own, or --add-topic/--remove-topic together.', exit_1.EXIT_USAGE);
             }
             const target = await (0, target_1.targetFrom)(inv);
             const repo = await (0, repo_1.resolveRepo)(inv, target, inv.args[0] ?? null);
+            let topics = clear ? [] : set.length ? set : undefined;
+            if (add.length || remove.length) {
+                const current = (await (0, cli_api_1.api)(target, 'GET', (0, repo_1.repoPath)(repo))).topics;
+                topics = [...new Set([...(current ?? []), ...add])].filter((t) => !remove.includes(t));
+            }
+            if (description === null &&
+                defaultBranch === null &&
+                upstream === null &&
+                topics === undefined &&
+                priv === undefined &&
+                siteEnabled === undefined &&
+                siteSource === null &&
+                sitePath === null &&
+                siteLabel === null &&
+                siteDomain === null) {
+                throw new exit_1.CliError('Nothing to change. Pass --description, --topic, --add-topic, --remove-topic, --clear-topics, --default-branch, --upstream, --private, --public, --enable-site, --disable-site, --site-source, --site-path, --site-label, or --site-domain.', exit_1.EXIT_USAGE);
+            }
             const data = await (0, cli_api_1.api)(target, 'PATCH', (0, repo_1.repoPath)(repo), {
                 description: description ?? undefined,
+                topics,
                 defaultBranch: defaultBranch ?? undefined,
+                upstream: upstream ?? undefined,
                 private: priv,
+                siteEnabled,
+                siteSource: siteSource ?? undefined,
+                sitePath: sitePath ?? undefined,
+                siteLabel: siteLabel ?? undefined,
+                siteDomain: siteDomain ?? undefined,
             });
             const json = (0, output_1.jsonMode)(inv);
             if (json.enabled) {
@@ -188,6 +275,11 @@ exports.repoCommands = [
                 return;
             }
             console.log(`Updated ${data.collection}/${data.name}`);
+            const published = data.sitePublish;
+            if (published?.error)
+                console.error(`The site could not be published from the repository: ${published.error}`);
+            else if (published?.files !== undefined)
+                console.log(`Site published from the repository: ${published.files} file(s)`);
         },
     },
     {
@@ -246,6 +338,42 @@ together.`,
             console.log(`Deleted ${full}`);
         },
     },
+    {
+        path: ['repo', 'gc'],
+        summary: 'Drop every object no branch or tag can reach',
+        description: `Git adds objects and never removes them, so a force push, a deleted branch, or a
+rewritten history leaves what it abandoned in the repository: unreachable from
+any ref, still readable by anyone who knows the hash, and still counted against
+the disk. This drops all of it now.
+
+The vault collects each repository on its own every few hours, sparing anything
+unreachable but newer than two days so that a push in flight is never pruned.
+This command is for when that is not soon enough: a file rewritten out of a
+history is unreachable at once, but until it is collected it can still be
+fetched by naming its commit. Objects younger than five minutes are still
+spared, which is the same in-flight push the sweep protects.
+
+Takes the admin role on the repository. What it removes cannot be recovered.`,
+        args: [{ name: 'repo' }],
+        options: [YES_OPTION, output_1.JSON_OPTION, ...target_1.TARGET_OPTIONS],
+        async run(inv) {
+            requireYes(inv, 'Dropping unreachable objects');
+            const target = await (0, target_1.targetFrom)(inv);
+            const repo = await (0, repo_1.resolveRepo)(inv, target, inv.args[0]);
+            const full = `${repo.collection}/${repo.repo}`;
+            const data = await (0, cli_api_1.api)(target, 'POST', `${(0, repo_1.repoPath)(repo)}/gc?confirm=${encodeURIComponent(full)}`);
+            const json = (0, output_1.jsonMode)(inv);
+            if (json.enabled) {
+                (0, output_1.printJson)((0, output_1.pickObject)(data, json.fields));
+                return;
+            }
+            const removed = Number(data.removed ?? 0);
+            const freed = Number(data.kilobytesFreed ?? 0);
+            console.log(removed === 0
+                ? `Collected ${full}; nothing was unreachable.`
+                : `Collected ${full}: ${removed} object${removed === 1 ? '' : 's'} dropped, ${freed >= 1024 ? `${(freed / 1024).toFixed(1)} MB` : `${freed} KB`} freed.`);
+        },
+    },
     {
         path: ['repo', 'clone'],
         summary: 'git clone, with the vault URL filled in',

package/dist/cli/sync-cmd.js

@@ -0,0 +1,128 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncCommand = void 0;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const cli_api_1 = require("../cli-api");
+const source_1 = require("../source");
+const exit_1 = require("./exit");
+const gitrun_1 = require("./gitrun");
+const repo_1 = require("./repo");
+const target_1 = require("./target");
+// `mochi sync`: bring a fork's branch up to date with the upstream it was
+// forked from. Without this a fork silently rots, and a pull request exported
+// from a stale base arrives already conflicted.
+//
+// Like import and export, it runs on the operator's machine: a bare clone of
+// the vault's branch, a fetch from the upstream URL on top of it (so only the
+// new objects cross the network), and a push of the result back to the vault.
+// The push is not forced, and the vault refuses non-fast-forwards anyway, so a
+// branch that has grown its own commits is reported as diverged rather than
+// overwritten.
+exports.syncCommand = {
+    path: ['sync'],
+    summary: 'Fast-forward a branch from the upstream the repository was forked from',
+    description: `The upstream is the URL \`mochi fork\` recorded (or \`mochi repo edit --upstream\`
+set). The branch defaults to the repository's default branch. The fetch uses
+whatever git credentials this machine already has, the push uses your mochi
+token, and only a fast-forward is ever pushed: a branch that has diverged from
+its upstream is reported and left alone.`,
+    args: [{ name: 'repo' }],
+    options: [
+        { name: 'branch', type: 'string', value: '<b>', summary: 'Branch to sync (default: the default branch)' },
+        repo_1.REPO_OPTION,
+        ...target_1.TARGET_OPTIONS,
+    ],
+    async run(inv) {
+        const target = await (0, target_1.targetFrom)(inv);
+        const ref = await (0, repo_1.resolveRepo)(inv, target, inv.args[0] ?? null);
+        const data = await (0, cli_api_1.api)(target, 'GET', (0, repo_1.repoPath)(ref));
+        const upstream = (0, source_1.parseUpstream)(String(data.upstream ?? ''));
+        if (!upstream) {
+            throw new exit_1.CliError(`${ref.collection}/${ref.repo} has no upstream recorded. Fork with mochi fork, or record one:\n` +
+                `  mochi repo edit ${ref.collection}/${ref.repo} --upstream https://github.com/owner/repo`, exit_1.EXIT_USAGE);
+        }
+        const branch = inv.str('branch') ?? String(data.defaultBranch ?? '');
+        if (!branch)
+            throw new exit_1.CliError('No branch to sync: the repository is empty. Pass --branch.', exit_1.EXIT_USAGE);
+        const vaultUrl = `${target.host}/${encodeURIComponent(ref.collection)}/${encodeURIComponent(ref.repo)}`;
+        const env = (0, gitrun_1.mochiCredentialEnv)('mochi', target.token);
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'mochi-sync-'));
+        try {
+            // The vault side first, so the upstream fetch only carries what is new.
+            console.log(`Fetching ${ref.collection}/${ref.repo} @ ${branch}`);
+            if ((await (0, gitrun_1.run)('git', [...(0, gitrun_1.mochiCredentialArgs)(), 'clone', '--bare', '--quiet', '--single-branch', '--branch', branch, vaultUrl, tmp], env)) !== 0) {
+                throw new exit_1.CliError(`Could not fetch branch ${branch} from ${vaultUrl}.`, exit_1.EXIT_FAIL);
+            }
+            console.log(`Fetching ${upstream.label} @ ${branch}`);
+            if ((await (0, gitrun_1.run)('git', ['-C', tmp, 'fetch', '--quiet', upstream.url, branch])) !== 0) {
+                throw new exit_1.CliError(`Could not fetch branch ${branch} from ${upstream.url}.`, exit_1.EXIT_FAIL);
+            }
+            const count = async (range) => {
+                const out = await (0, gitrun_1.capture)('git', ['-C', tmp, 'rev-list', '--count', range]);
+                if (out === null)
+                    throw new exit_1.CliError('git rev-list failed in the temporary clone.', exit_1.EXIT_FAIL);
+                return parseInt(out.trim(), 10);
+            };
+            const behind = await count(`refs/heads/${branch}..FETCH_HEAD`);
+            const ahead = await count(`FETCH_HEAD..refs/heads/${branch}`);
+            if (behind === 0) {
+                console.log(ahead === 0
+                    ? `${branch} is up to date with ${upstream.label}.`
+                    : `${branch} is up to date with ${upstream.label}, and ${ahead} commit${ahead === 1 ? '' : 's'} ahead of it.`);
+                return;
+            }
+            if (ahead > 0) {
+                throw new exit_1.CliError(`${branch} has diverged from ${upstream.label}: ${ahead} commit${ahead === 1 ? '' : 's'} of its own, ` +
+                    `${behind} upstream. Nothing was pushed; merge or rebase by hand in a clone.`, exit_1.EXIT_CONFLICT);
+            }
+            console.log(`Pushing ${behind} commit${behind === 1 ? '' : 's'} to ${vaultUrl}`);
+            if ((await (0, gitrun_1.run)('git', ['-C', tmp, ...(0, gitrun_1.mochiCredentialArgs)(), 'push', '--quiet', vaultUrl, `FETCH_HEAD:refs/heads/${branch}`], env)) !== 0) {
+                throw new exit_1.CliError(`Could not push ${branch} to ${vaultUrl}.`, exit_1.EXIT_FAIL);
+            }
+            console.log(`Fast-forwarded ${branch} by ${behind} commit${behind === 1 ? '' : 's'} from ${upstream.label}.`);
+        }
+        finally {
+            try {
+                fs.rmSync(tmp, { recursive: true, force: true });
+            }
+            catch {
+                // A leftover temporary directory is not worth failing the sync over.
+            }
+        }
+    },
+};

package/dist/cli/target.js

@@ -3,23 +3,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TARGET_OPTIONS = void 0;
 exports.targetFrom = targetFrom;
 const cli_api_1 = require("../cli-api");
+const naming_1 = require("../naming");
 const exit_1 = require("./exit");
 const input_1 = require("./input");
 // Which vault a command talks to, and with what token. Every command that
 // reaches a vault takes the same three options, declared once here so that they
 // are spelled and documented identically everywhere.
+// The summaries read naming at module load, which is after a sibling
+// application's branding module has run (it is that application's first
+// import), and is simply the mochi defaults everywhere else.
 exports.TARGET_OPTIONS = [
     {
         name: 'host',
         type: 'string',
         value: '<url>',
-        summary: 'Vault URL, ahead of MOCHI_HOST and the last login',
+        summary: `${naming_1.naming.rootNoun[0].toUpperCase()}${naming_1.naming.rootNoun.slice(1)} URL, ahead of ${naming_1.naming.envPrefix}_HOST and the last login`,
     },
     {
         name: 'token',
         type: 'string',
         value: '<t>',
-        summary: "Token, ahead of MOCHI_TOKEN and git's credential store",
+        summary: `Token, ahead of ${naming_1.naming.envPrefix}_TOKEN and git's credential store`,
     },
     {
         name: 'token-stdin',
@@ -49,6 +53,6 @@ async function targetFrom(inv, opts = {}) {
         if (!token)
             throw new exit_1.CliError('--token-stdin was given but stdin was empty.', exit_1.EXIT_AUTH);
     }
-    const host = inv.str('host') ?? process.env.MOCHI_HOST?.trim() ?? opts.host ?? null;
+    const host = inv.str('host') ?? process.env[`${naming_1.naming.envPrefix}_HOST`]?.trim() ?? opts.host ?? null;
     return await (0, cli_api_1.remoteTarget)({ host, token });
 }

package/dist/config.js

@@ -67,6 +67,7 @@ function configFilePath(root) {
 }
 const DEFAULTS = {
     theme: themes_1.DEFAULT_THEME,
+    auth: { githubClientId: '' },
     ci: { runs: 100, days: 0, artifactMb: 500 },
     sites: { host: '' },
     network: { trustProxy: false },
@@ -78,6 +79,7 @@ const DEFAULTS = {
 function defaults() {
     return {
         ...DEFAULTS,
+        auth: { ...DEFAULTS.auth },
         ci: { ...DEFAULTS.ci },
         sites: { ...DEFAULTS.sites },
         network: { ...DEFAULTS.network },
@@ -96,6 +98,14 @@ function readConfig(file) {
         // request: a typo in config.json should not take the vault down.
         if (typeof parsed.theme === 'string' && (0, themes_1.findTheme)(parsed.theme))
             config.theme = parsed.theme;
+        // The client id is public and its exact shape is GitHub's business; the
+        // check refuses only whitespace and control characters, which could not
+        // be one and would otherwise ride into a redirect URL.
+        if (typeof parsed.auth === 'object' && parsed.auth !== null) {
+            const auth = parsed.auth;
+            const id = typeof auth.githubClientId === 'string' ? auth.githubClientId.trim() : '';
+            config.auth = { githubClientId: /^[\x21-\x7e]{1,100}$/.test(id) ? id : DEFAULTS.auth.githubClientId };
+        }
         // Run retention: a vault's run history is the one part of its state that
         // grows without bound, so it is bounded by default and tunable here.
         if (typeof parsed.ci === 'object' && parsed.ci !== null) {

package/dist/credentials.js

@@ -49,6 +49,7 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const naming_1 = require("./naming");
 // The client side of authentication. A token is the password git sends over
 // Basic auth, so the place to keep it is git's own credential store: clone,
 // fetch, push, and git-lfs all read credentials through the same `git
@@ -171,7 +172,7 @@ async function rejectCredential(target, username) {
 // makes `mochi user list` work with no arguments and no environment.
 function loginPath() {
     const base = process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config');
-    return path.join(base, 'mochi', 'login.json');
+    return path.join(base, naming_1.naming.configDirName, 'login.json');
 }
 function loadLogin(file = loginPath()) {
     try {
@@ -212,13 +213,13 @@ function clearLogin(host, file = loginPath()) {
 // configures, and the runner already took this shape with
 // MOCHI_RUNNER_TOKEN.
 async function vaultTarget(args) {
-    const envHost = process.env.MOCHI_HOST?.trim() || null;
-    const envToken = process.env.MOCHI_TOKEN?.trim() || null;
+    const envHost = process.env[`${naming_1.naming.envPrefix}_HOST`]?.trim() || null;
+    const envToken = process.env[`${naming_1.naming.envPrefix}_TOKEN`]?.trim() || null;
     const host = (args.host ?? envHost ?? loadLogin()?.host ?? '').replace(/\/+$/, '');
     if (!host) {
-        throw new CredentialError('No vault. Log in to one first:\n\n' +
-            '  mochi login https://vault.example.com\n\n' +
-            'or pass --host <url>, or set MOCHI_HOST.');
+        throw new CredentialError(`No ${naming_1.naming.rootNoun}. Log in to one first:\n\n` +
+            `  ${naming_1.naming.product} login https://${naming_1.naming.rootNoun}.example.com\n\n` +
+            `or pass --host <url>, or set ${naming_1.naming.envPrefix}_HOST.`);
     }
     if (args.token)
         return { host, token: args.token };
@@ -228,8 +229,8 @@ async function vaultTarget(args) {
     const stored = await readCredential(target);
     if (!stored) {
         throw new CredentialError(`No stored token for ${target.url}. Log in again:\n\n` +
-            `  mochi login ${target.url}\n\n` +
-            'or pass --token <token>, or set MOCHI_TOKEN.');
+            `  ${naming_1.naming.product} login ${target.url}\n\n` +
+            `or pass --token <token>, or set ${naming_1.naming.envPrefix}_TOKEN.`);
     }
     return { host, token: stored.password };
 }