npm - @magland/mochi - Versions diffs - 0.3.1 - Mend

@magland/mochi 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (116) hide show

package/LICENSE +201 -0
package/README.md +108 -0
package/dist/ansi.js +174 -0
package/dist/api/admin.js +416 -0
package/dist/api/auth.js +166 -0
package/dist/api/backup.js +598 -0
package/dist/api/ci.js +336 -0
package/dist/api/contents.js +339 -0
package/dist/api/issues.js +165 -0
package/dist/api/pulls.js +244 -0
package/dist/api/releases.js +83 -0
package/dist/api/repos.js +156 -0
package/dist/api/write.js +518 -0
package/dist/api.js +326 -0
package/dist/assets.js +29 -0
package/dist/atom.js +32 -0
package/dist/atomic.js +171 -0
package/dist/avatar.js +81 -0
package/dist/browse.js +630 -0
package/dist/build-info.json +4 -0
package/dist/ci/actionref.js +86 -0
package/dist/ci/api.js +829 -0
package/dist/ci/artifacts.js +201 -0
package/dist/ci/dispatch.js +30 -0
package/dist/ci/engine.js +1321 -0
package/dist/ci/expr.js +526 -0
package/dist/ci/manual.js +199 -0
package/dist/ci/present.js +82 -0
package/dist/ci/protocol.js +6 -0
package/dist/ci/runners.js +256 -0
package/dist/ci/runs.js +208 -0
package/dist/ci/trigger.js +28 -0
package/dist/ci/views.js +441 -0
package/dist/ci/wake.js +194 -0
package/dist/ci/web.js +617 -0
package/dist/ci/workflow.js +436 -0
package/dist/cli/admin-cmd.js +324 -0
package/dist/cli/api-cmd.js +128 -0
package/dist/cli/backup-cmd.js +1500 -0
package/dist/cli/exit.js +69 -0
package/dist/cli/input.js +64 -0
package/dist/cli/issue-cmd.js +243 -0
package/dist/cli/output.js +93 -0
package/dist/cli/parse.js +317 -0
package/dist/cli/pr-cmd.js +289 -0
package/dist/cli/release-cmd.js +171 -0
package/dist/cli/repo-cmd.js +763 -0
package/dist/cli/repo.js +101 -0
package/dist/cli/run-cmd.js +438 -0
package/dist/cli/target.js +54 -0
package/dist/cli-api.js +84 -0
package/dist/compare.js +111 -0
package/dist/config.js +212 -0
package/dist/credentials.js +235 -0
package/dist/deploy-cli.js +859 -0
package/dist/deploy-runner-cli.js +592 -0
package/dist/diff.js +171 -0
package/dist/discussion.js +253 -0
package/dist/egress.js +559 -0
package/dist/filecache.js +68 -0
package/dist/find.js +162 -0
package/dist/forms.js +737 -0
package/dist/git.js +547 -0
package/dist/githttp.js +428 -0
package/dist/html.js +87 -0
package/dist/icons.js +101 -0
package/dist/import-cli.js +316 -0
package/dist/index.js +752 -0
package/dist/issues.js +308 -0
package/dist/issueweb.js +447 -0
package/dist/job-cli.js +197 -0
package/dist/jobtoken.js +96 -0
package/dist/languages.js +383 -0
package/dist/layout.js +100 -0
package/dist/lfs.js +438 -0
package/dist/lfsstore.js +425 -0
package/dist/limit.js +259 -0
package/dist/logo.js +61 -0
package/dist/markdown.js +382 -0
package/dist/migrate.js +334 -0
package/dist/multipart.js +90 -0
package/dist/ops.js +869 -0
package/dist/pagescript.js +465 -0
package/dist/perms.js +370 -0
package/dist/pointer.js +55 -0
package/dist/profile.js +106 -0
package/dist/pulls.js +320 -0
package/dist/pullweb.js +461 -0
package/dist/redirects.js +455 -0
package/dist/releases.js +435 -0
package/dist/render.js +233 -0
package/dist/runner/actions.js +448 -0
package/dist/runner/client.js +428 -0
package/dist/runner/context.js +247 -0
package/dist/runner/docker.js +197 -0
package/dist/runner/externals.js +175 -0
package/dist/runner/job.js +290 -0
package/dist/runner/manual-run.js +272 -0
package/dist/runner/overrides.js +554 -0
package/dist/runner/steps.js +571 -0
package/dist/runner/wake.js +84 -0
package/dist/runner-cli.js +405 -0
package/dist/scan.js +231 -0
package/dist/server.js +424 -0
package/dist/session.js +267 -0
package/dist/site.js +259 -0
package/dist/siteshost.js +94 -0
package/dist/source.js +90 -0
package/dist/style.js +1295 -0
package/dist/themes.js +369 -0
package/dist/vault.js +442 -0
package/dist/version.js +88 -0
package/dist/views.js +1007 -0
package/dist/web.js +182 -0
package/dist/webops.js +1402 -0
package/package.json +71 -0

package/dist/compare.js ADDED Viewed

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCompare = registerCompare;
+const diff_1 = require("./diff");
+const git_1 = require("./git");
+const html_1 = require("./html");
+const icons_1 = require("./icons");
+const render_1 = require("./render");
+const session_1 = require("./session");
+const views_1 = require("./views");
+const web_1 = require("./web");
+// Comparing two revisions: what one branch has that another does not, and the
+// patch between them. Without it, seeing how a branch differs from main means
+// cloning the repository, which is a strange thing for a web interface to
+// require of a reader.
+//
+// The address is GitHub's: /compare/<base>...<head>, three dots for the
+// comparison taken from the merge base. The form posts to /compare with the
+// two refs as query parameters and the handler accepts either shape, since a
+// GET form cannot build a path.
+/** The most commits a comparison lists before saying there are more. */
+const MAX_COMMITS = 250;
+function refOptions(refs, selected) {
+    return (0, html_1.joinHtml)(refs.map((r) => (0, html_1.html) `<option value="${r.name}"${r.name === selected ? (0, html_1.raw)(' selected') : ''}>${r.name}</option>`));
+}
+function picker(ctx, name, label, selected) {
+    const groups = [
+        ctx.branches.length ? (0, html_1.html) `<optgroup label="Branches">${refOptions(ctx.branches, selected)}</optgroup>` : '',
+        ctx.tags.length ? (0, html_1.html) `<optgroup label="Tags">${refOptions(ctx.tags, selected)}</optgroup>` : '',
+    ];
+    const known = [...ctx.branches, ...ctx.tags].some((r) => r.name === selected);
+    const loose = known ? '' : (0, html_1.html) `<option value="${selected}" selected>${selected}</option>`;
+    return (0, html_1.html) `<label class="cmp-picker">${label}
+<select name="${name}">${loose}${groups}</select></label>`;
+}
+function commitRows(ctx, commits) {
+    const base = (0, views_1.repoUrl)(ctx);
+    return (0, html_1.joinHtml)(commits.map((c) => (0, html_1.html) `<div class="commit-row"><span class="commit-main"><a class="title" href="${base}/commit/${c.sha}">${c.subject}</a><div class="muted small">${c.author} committed ${(0, render_1.timeTag)(c.date)}</div></span><span class="commit-actions"><a class="sha" href="${base}/commit/${c.sha}">${c.sha.slice(0, 7)}</a></span></div>`));
+}
+function comparePage(ctx, baseRef, headRef, result) {
+    const base = (0, views_1.repoUrl)(ctx);
+    const url = `${base}/compare/${(0, views_1.encPath)(baseRef)}...${(0, views_1.encPath)(headRef)}`;
+    const form = (0, html_1.html) `<form class="cmp-form" method="get" action="${base}/compare">
+${(0, icons_1.icon)('git-branch')}${picker(ctx, 'base', 'base', baseRef)}<span class="muted">&hellip;</span>${picker(ctx, 'head', 'compare', headRef)}
+<a class="btn" href="${base}/compare/${(0, views_1.encPath)(headRef)}...${(0, views_1.encPath)(baseRef)}" title="Swap the two revisions">${(0, icons_1.icon)('sync')}<span>Swap</span></a>
+<button class="btn btn-primary" type="submit">Compare</button>
+</form>`;
+    let body;
+    if (!result) {
+        body = (0, html_1.html) `<div class="empty-state">Choose two revisions to compare.</div>`;
+    }
+    else if (result.commits.length === 0 && result.patch === '') {
+        body = (0, html_1.html) `<div class="empty-state">These two revisions are identical.</div>`;
+    }
+    else {
+        const behind = result.behind > 0
+            ? (0, html_1.html) ` <span class="muted">and is ${result.behind} commit${result.behind === 1 ? '' : 's'} behind</span>`
+            : '';
+        const more = result.ahead > result.commits.length
+            ? (0, html_1.html) `<p class="muted small">Showing the newest ${result.commits.length} of ${result.ahead} commits.</p>`
+            : '';
+        // A comparison with something on it is a pull request waiting to be
+        // written, which is the path GitHub puts here too.
+        const propose = result.ahead > 0 && ctx.branches.some((b) => b.name === headRef) && ctx.branches.some((b) => b.name === baseRef)
+            ? (0, html_1.html) `<a class="btn btn-primary" href="${base}/pulls/new?base=${encodeURIComponent(baseRef)}&amp;head=${encodeURIComponent(headRef)}">${(0, icons_1.icon)('git-pull-request')}<span>Create pull request</span></a>`
+            : '';
+        body = (0, html_1.html) `<div class="cmp-status">
+  <span><b>${headRef}</b> is <b>${result.ahead} commit${result.ahead === 1 ? '' : 's'}</b> ahead of <b>${baseRef}</b>${behind}.</span>
+  ${propose}
+</div>
+${more}
+<div class="cmp-commits">${commitRows(ctx, result.commits)}</div>
+<div class="cmp-diff">${(0, html_1.raw)((0, diff_1.renderDiff)(result.patch, { blobBase: `${base}/blob/${(0, views_1.encPath)(headRef)}` }))}</div>`;
+    }
+    const content = (0, html_1.html) `${(0, views_1.repoHeader)(ctx, 'branches')}
+<div class="page-head"><h2>Comparing changes</h2></div>
+${form}
+${body}`;
+    return (0, views_1.layout)(`Comparing ${baseRef}...${headRef} - ${ctx.collection}/${ctx.repo}`, content, (0, views_1.repoOpts)(ctx, url));
+}
+function registerCompare(app, root) {
+    const handler = (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, session_1.getViewer)(req, root);
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const fallback = loaded.defaultBranch ?? '';
+        // Either shape: /compare/<base>...<head> from a link, or ?base=&head=
+        // from the form. Two dots are accepted as well, since people type them.
+        const spec = (0, web_1.wildcard)(req);
+        const split = spec.includes('...') ? spec.split('...') : spec.includes('..') ? spec.split('..') : null;
+        const baseRef = (split ? split[0] : String(req.query.base ?? '')) || fallback;
+        const headRef = (split ? split[1] : String(req.query.head ?? '')) || fallback;
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, headRef || fallback, viewer);
+        // Only revisions this repository has: a comparison takes two arguments
+        // from a URL and hands both to git.
+        const known = (r) => loaded.refNames.includes(r) || /^[0-9a-f]{7,40}$/.test(r);
+        if (baseRef === '' || headRef === '') {
+            res.type('html').send(comparePage(ctx, baseRef, headRef, null));
+            return;
+        }
+        if (!(0, git_1.isValidRefName)(baseRef) || !(0, git_1.isValidRefName)(headRef) || !known(baseRef) || !known(headRef)) {
+            (0, web_1.send404)(res, `No revision ${known(baseRef) ? headRef : baseRef} here`, viewer);
+            return;
+        }
+        const result = await loaded.repo.compare(baseRef, headRef, MAX_COMMITS);
+        res.type('html').send(comparePage(ctx, baseRef, headRef, result));
+    });
+    app.get('/:collection/:repo/compare/*', handler);
+    app.get('/:collection/:repo/compare', handler);
+}

package/dist/config.js ADDED Viewed

@@ -0,0 +1,212 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIG_FILE = void 0;
+exports.isPlausibleHostname = isPlausibleHostname;
+exports.configFilePath = configFilePath;
+exports.loadConfig = loadConfig;
+exports.saveConfig = saveConfig;
+exports.seedTrustProxy = seedTrustProxy;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const atomic_1 = require("./atomic");
+const filecache_1 = require("./filecache");
+const siteshost_1 = require("./siteshost");
+const themes_1 = require("./themes");
+// Vault-level settings, kept in <vault>/config.json next to vault.json. Like
+// everything else, this is a plain file in the vault: hand-editing it is
+// legitimate, and a missing or unreadable file simply means defaults.
+exports.CONFIG_FILE = 'config.json';
+// A hostname of at least two labels, each of letters, digits, and interior
+// hyphens. A value carrying a scheme, a port, or a single label is not one, and
+// is treated as a typo rather than obeyed.
+const HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+/**
+ * Whether a string is usable as a hostname in this file's settings. Exported so
+ * that a route accepting one refuses a typo with a message, rather than storing
+ * it and leaving loadConfig to fall back to the default silently: a setting
+ * written through the API is being watched by someone who wants to know.
+ */
+function isPlausibleHostname(value) {
+    return HOSTNAME_RE.test(value);
+}
+function configFilePath(root) {
+    return path.join(root, exports.CONFIG_FILE);
+}
+const DEFAULTS = {
+    theme: themes_1.DEFAULT_THEME,
+    ci: { runs: 100, days: 0, artifactMb: 500 },
+    sites: { host: '' },
+    network: { trustProxy: false },
+    // 20 GB a day is generous for a personal forge and cheap if it is ever all
+    // sent: it is the number that stops a crawler or a CI loop turning a host
+    // that bills for egress and does not cap it into a bill nobody chose.
+    limits: { requestsPerMinute: 600, authFailures: 10, clone: 4, push: 4, search: 2, tree: 4, egressGbPerDay: 20 },
+};
+function defaults() {
+    return {
+        ...DEFAULTS,
+        ci: { ...DEFAULTS.ci },
+        sites: { ...DEFAULTS.sites },
+        network: { ...DEFAULTS.network },
+        limits: { ...DEFAULTS.limits },
+    };
+}
+const cache = (0, filecache_1.fileCache)({ read: readConfig, missing: () => defaults() });
+function loadConfig(root) {
+    return cache.get(configFilePath(root));
+}
+function readConfig(file) {
+    let config = defaults();
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        // An unknown theme name falls back to the default rather than failing the
+        // request: a typo in config.json should not take the vault down.
+        if (typeof parsed.theme === 'string' && (0, themes_1.findTheme)(parsed.theme))
+            config.theme = parsed.theme;
+        // Run retention: a vault's run history is the one part of its state that
+        // grows without bound, so it is bounded by default and tunable here.
+        if (typeof parsed.ci === 'object' && parsed.ci !== null) {
+            const ci = parsed.ci;
+            const runs = typeof ci.runs === 'number' && ci.runs >= 0 ? Math.floor(ci.runs) : DEFAULTS.ci.runs;
+            const days = typeof ci.days === 'number' && ci.days >= 0 ? Math.floor(ci.days) : DEFAULTS.ci.days;
+            const artifactMb = typeof ci.artifactMb === 'number' && ci.artifactMb > 0 ? Math.floor(ci.artifactMb) : DEFAULTS.ci.artifactMb;
+            config.ci = { runs, days, artifactMb };
+        }
+        // A site host lets each repository's site have an origin of its own. A
+        // value that is not a plausible hostname is ignored the way an unknown
+        // theme name is: a typo here would otherwise stop sites being served at
+        // all, or worse, serve them from a name that is not the one the
+        // certificate covers.
+        if (typeof parsed.sites === 'object' && parsed.sites !== null) {
+            const sites = parsed.sites;
+            const raw = typeof sites.host === 'string' ? (0, siteshost_1.normalizeHostname)(sites.host) : '';
+            config.sites = { host: isPlausibleHostname(raw) ? raw : DEFAULTS.sites.host };
+        }
+        // Whether the forwarded headers may be believed. False by default, because
+        // believing them on a directly exposed vault lets any client claim any
+        // address, which defeats every per-address limit and makes the limiter's own
+        // key space unbounded.
+        if (typeof parsed.network === 'object' && parsed.network !== null) {
+            const network = parsed.network;
+            config.network = {
+                trustProxy: typeof network.trustProxy === 'boolean' ? network.trustProxy : DEFAULTS.network.trustProxy,
+            };
+        }
+        // Each field falls back to its own default, so one bad value does not
+        // discard the block.
+        if (typeof parsed.limits === 'object' && parsed.limits !== null) {
+            const limits = parsed.limits;
+            // A limit may be 0, which disables it. A concurrency may not: a gate of
+            // zero slots would refuse everything forever, which is an outage rather
+            // than a setting, so it is treated as a bad value.
+            const limit = (v, fallback) => typeof v === 'number' && Number.isFinite(v) && v >= 0 ? Math.floor(v) : fallback;
+            const slots = (v, fallback) => typeof v === 'number' && Number.isFinite(v) && v >= 1 ? Math.floor(v) : fallback;
+            // Not floored, unlike the two above: half a gigabyte is a reasonable
+            // budget to give a vault, and 0 disables the cap.
+            const gigabytes = (v, fallback) => typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : fallback;
+            config.limits = {
+                requestsPerMinute: limit(limits.requestsPerMinute, DEFAULTS.limits.requestsPerMinute),
+                authFailures: limit(limits.authFailures, DEFAULTS.limits.authFailures),
+                clone: slots(limits.clone, DEFAULTS.limits.clone),
+                push: slots(limits.push, DEFAULTS.limits.push),
+                search: slots(limits.search, DEFAULTS.limits.search),
+                tree: slots(limits.tree, DEFAULTS.limits.tree),
+                egressGbPerDay: gigabytes(limits.egressGbPerDay, DEFAULTS.limits.egressGbPerDay),
+            };
+        }
+    }
+    catch {
+        config = defaults();
+    }
+    return config;
+}
+/**
+ * Hold config.json's lock across a read, an edit, and the write back.
+ *
+ * `mochi config set` and `PATCH /api/config` merge changes into whatever is
+ * on disk, so two of them overlapping keeps one change and drops the other. The
+ * cache is dropped on the way in for the same reason it is in the runner
+ * registry: an unchanged mtime and size is a good enough guess for a read, and
+ * not good enough for the read half of a read-modify-write.
+ *
+ * The lock is not reentrant, so anything that needs to look at the file before
+ * deciding whether to save calls `saveLocked` from inside its own `editConfig`
+ * rather than calling `saveConfig`.
+ */
+function editConfig(root, fn) {
+    return (0, atomic_1.withFileLock)(`${configFilePath(root)}.lock`, () => {
+        cache.invalidate(configFilePath(root));
+        return fn();
+    });
+}
+function saveLocked(root, changes) {
+    const next = { ...loadConfig(root), ...changes };
+    (0, atomic_1.writeFileAtomic)(configFilePath(root), JSON.stringify(next, null, 2) + '\n');
+    cache.invalidate(configFilePath(root));
+    return next;
+}
+function saveConfig(root, changes) {
+    return editConfig(root, () => saveLocked(root, changes));
+}
+/**
+ * Record network.trustProxy: true unless the vault has already said something
+ * about it. Called by `serve` when MOCHI_TRUST_PROXY is set, which is how
+ * `mochi deploy fly` tells a vault it is behind a proxy: the deploy cannot
+ * write to the volume itself, since the vault does not exist until the server
+ * starts.
+ *
+ * It runs on every start and not only on a fresh vault, because a vault created
+ * before this setting existed would otherwise come back from an upgrade with
+ * forwarded headers no longer believed, which would break its clone URLs and its
+ * Secure cookies. An explicit value in config.json is always left alone, so
+ * turning it off by hand stays turned off.
+ */
+function seedTrustProxy(root) {
+    return editConfig(root, () => {
+        let parsed = {};
+        try {
+            parsed = JSON.parse(fs.readFileSync(configFilePath(root), 'utf8'));
+        }
+        catch {
+            parsed = {};
+        }
+        const network = typeof parsed.network === 'object' && parsed.network !== null ? parsed.network : {};
+        if (typeof network.trustProxy === 'boolean')
+            return false;
+        saveLocked(root, { network: { trustProxy: true } });
+        return true;
+    });
+}

package/dist/credentials.js ADDED Viewed

@@ -0,0 +1,235 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialError = void 0;
+exports.credentialTarget = credentialTarget;
+exports.configuredHelper = configuredHelper;
+exports.setHelper = setHelper;
+exports.approveCredential = approveCredential;
+exports.readCredential = readCredential;
+exports.rejectCredential = rejectCredential;
+exports.loginPath = loginPath;
+exports.loadLogin = loadLogin;
+exports.saveLogin = saveLogin;
+exports.clearLogin = clearLogin;
+exports.vaultTarget = vaultTarget;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// The client side of authentication. A token is the password git sends over
+// Basic auth, so the place to keep it is git's own credential store: clone,
+// fetch, push, and git-lfs all read credentials through the same `git
+// credential` plumbing, and storing it once there stops every one of them from
+// asking again. Nothing here is vault state. The server never learns that a
+// credential was stored, and `git credential reject` undoes it.
+class CredentialError extends Error {
+}
+exports.CredentialError = CredentialError;
+// Unlike execGit in git.ts, these commands are not about a repository, and a
+// non-zero exit is frequently the answer rather than a failure: `git config
+// --get-urlmatch` exits 1 when nothing matches, and `git credential fill`
+// exits non-zero when it has nothing to give. So this reports the exit code
+// instead of throwing on it.
+function git(args, opts = {}) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.execFile)('git', args, { env: opts.env ?? process.env, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
+            const code = err?.code;
+            if (code === 'ENOENT') {
+                reject(new CredentialError('git is not on PATH, so there is nowhere to store a credential'));
+                return;
+            }
+            resolve({ code: typeof code === 'number' ? code : err ? 1 : 0, stdout: String(stdout), stderr: String(stderr) });
+        });
+        if (child.stdin) {
+            if (opts.input !== undefined)
+                child.stdin.write(opts.input);
+            child.stdin.end();
+        }
+    });
+}
+// git keys credentials by protocol and host, the port included. The path plays
+// no part unless credential.useHttpPath is set, so a vault served under a
+// subpath is still one credential for the whole vault.
+function credentialTarget(hostUrl) {
+    let u;
+    try {
+        u = new URL(hostUrl);
+    }
+    catch {
+        throw new CredentialError(`Not a URL: ${hostUrl}`);
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        throw new CredentialError(`${hostUrl} is not an http or https URL`);
+    }
+    const protocol = u.protocol.slice(0, -1);
+    return { protocol, host: u.host, url: `${protocol}://${u.host}` };
+}
+// The credential description git reads on stdin: key=value lines, then a blank
+// line. A newline inside a value would let it forge further fields, so values
+// carrying one are refused rather than written.
+function describe(target, fields) {
+    const lines = [`protocol=${target.protocol}`, `host=${target.host}`];
+    for (const [key, value] of Object.entries(fields)) {
+        if (/[\n\r\0]/.test(value))
+            throw new CredentialError(`${key} contains a line break`);
+        lines.push(`${key}=${value}`);
+    }
+    return lines.join('\n') + '\n\n';
+}
+function parseCredential(stdout) {
+    const out = {};
+    for (const line of stdout.split('\n')) {
+        const i = line.indexOf('=');
+        if (i > 0)
+            out[line.slice(0, i)] = line.slice(i + 1);
+    }
+    return out;
+}
+// What git would actually use for this host, taking both credential.helper and
+// any URL-scoped credential.<url>.helper into account. Null means none, which
+// matters more than it looks: `git credential approve` with no helper
+// configured succeeds and stores nothing at all.
+async function configuredHelper(url) {
+    const r = await git(['config', '--get-urlmatch', 'credential.helper', url]);
+    const value = r.stdout.trim();
+    return r.code === 0 && value !== '' ? value : null;
+}
+// Recorded for this URL alone, so other remotes keep whatever they use now.
+async function setHelper(url, helper) {
+    const r = await git(['config', '--global', `credential.${url}.helper`, helper]);
+    if (r.code !== 0) {
+        throw new CredentialError(r.stderr.trim() || `git config exited ${r.code}`);
+    }
+}
+async function approveCredential(target, username, password) {
+    const r = await git(['credential', 'approve'], { input: describe(target, { username, password }) });
+    if (r.code !== 0) {
+        throw new CredentialError(r.stderr.trim() || `git credential approve exited ${r.code}`);
+    }
+}
+// Reading back what is stored must never turn into a prompt. Without both of
+// these, a lookup that finds nothing would ask: through an editor's askpass
+// dialog when GIT_ASKPASS is set, which is invisible from the terminal the
+// command was run in, or on the terminal otherwise. An empty GIT_ASKPASS also
+// shadows core.askPass and SSH_ASKPASS, which git consults only when
+// GIT_ASKPASS is unset.
+async function readCredential(target) {
+    const r = await git(['credential', 'fill'], {
+        input: describe(target, {}),
+        env: { ...process.env, GIT_ASKPASS: '', GIT_TERMINAL_PROMPT: '0' },
+    });
+    if (r.code !== 0)
+        return null;
+    const c = parseCredential(r.stdout);
+    return c.username && c.password ? { username: c.username, password: c.password } : null;
+}
+async function rejectCredential(target, username) {
+    const r = await git(['credential', 'reject'], {
+        input: describe(target, username ? { username } : {}),
+    });
+    if (r.code !== 0) {
+        throw new CredentialError(r.stderr.trim() || `git credential reject exited ${r.code}`);
+    }
+}
+// Where the CLI remembers which vault it is talking to. The token itself is
+// never written here: it lives in git's credential store, put there by
+// `mochi login`, so there is one place a token is kept rather than two.
+// This file records only the vault URL of the most recent login, which is what
+// makes `mochi user list` work with no arguments and no environment.
+function loginPath() {
+    const base = process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config');
+    return path.join(base, 'mochi', 'login.json');
+}
+function loadLogin(file = loginPath()) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return typeof parsed.host === 'string' && parsed.host ? { host: parsed.host } : null;
+    }
+    catch {
+        return null;
+    }
+}
+function saveLogin(host, file = loginPath()) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ host }, null, 2) + '\n', { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+// Only forgets the vault named, so logging out of one vault does not silently
+// redirect commands that were aimed at another.
+function clearLogin(host, file = loginPath()) {
+    const saved = loadLogin(file);
+    if (!saved || saved.host !== host)
+        return;
+    try {
+        fs.rmSync(file);
+    }
+    catch {
+        /* nothing to remove */
+    }
+}
+// The vault a command should talk to, and the token to talk with. Precedence is
+// the same for both: the option, then the environment, then what `mochi
+// login` left behind (the URL in login.json, the token in git's credential
+// store).
+//
+// The environment is here for a caller that has no keyring and possibly no
+// writable home directory, which is an agent in a container rather than a
+// person at a laptop. `mochi login` remains the one thing a person
+// configures, and the runner already took this shape with
+// MOCHI_RUNNER_TOKEN.
+async function vaultTarget(args) {
+    const envHost = process.env.MOCHI_HOST?.trim() || null;
+    const envToken = process.env.MOCHI_TOKEN?.trim() || null;
+    const host = (args.host ?? envHost ?? loadLogin()?.host ?? '').replace(/\/+$/, '');
+    if (!host) {
+        throw new CredentialError('No vault. Log in to one first:\n\n' +
+            '  mochi login https://vault.example.com\n\n' +
+            'or pass --host <url>, or set MOCHI_HOST.');
+    }
+    if (args.token)
+        return { host, token: args.token };
+    if (envToken)
+        return { host, token: envToken };
+    const target = credentialTarget(host);
+    const stored = await readCredential(target);
+    if (!stored) {
+        throw new CredentialError(`No stored token for ${target.url}. Log in again:\n\n` +
+            `  mochi login ${target.url}\n\n` +
+            'or pass --token <token>, or set MOCHI_TOKEN.');
+    }
+    return { host, token: stored.password };
+}