@magland/mochi 0.3.1

package/dist/githttp.js

@@ -0,0 +1,428 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseBasicAuth = parseBasicAuth;
+exports.checkReadAuth = checkReadAuth;
+exports.checkPushAuth = checkPushAuth;
+exports.registerGitHttp = registerGitHttp;
+const child_process_1 = require("child_process");
+const zlib = __importStar(require("zlib"));
+const git_1 = require("./git");
+const jobtoken_1 = require("./jobtoken");
+const ops_1 = require("./ops");
+const perms_1 = require("./perms");
+const scan_1 = require("./scan");
+const limit_1 = require("./limit");
+const vault_1 = require("./vault");
+const web_1 = require("./web");
+// git smart HTTP. Anonymous fetch (upload-pack) stays open for public
+// repositories; a private one asks for Basic auth and then serves only a
+// reader. Push (receive-pack) always requires a token presented over HTTP
+// Basic auth. Session cookies are never consulted here: git and the browser
+// present distinct credentials by design.
+function pkt(s) {
+    return (s.length + 4).toString(16).padStart(4, '0') + s;
+}
+// The environment a git subprocess is given. GIT_PROTOCOL is how the version
+// the client asked for reaches git, and its value arrives in a request header,
+// so it is held to the shape git itself defines (`version=2`, and the
+// colon-separated key or key=value list the protocol allows) rather than being
+// passed on as written. Anything else is dropped, which leaves git at the
+// version it would have negotiated without the header.
+const GIT_PROTOCOL_RE = /^[A-Za-z0-9_.=-]{1,64}(:[A-Za-z0-9_.=-]{1,64})*$/;
+function gitEnv(req) {
+    const env = { ...process.env };
+    const proto = req.get('git-protocol');
+    if (proto && GIT_PROTOCOL_RE.test(proto))
+        env.GIT_PROTOCOL = proto;
+    return env;
+}
+function parseBasicAuth(req) {
+    const h = req.get('authorization');
+    if (!h || !/^basic /i.test(h))
+        return null;
+    let decoded;
+    try {
+        decoded = Buffer.from(h.slice(6).trim(), 'base64').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    const i = decoded.indexOf(':');
+    if (i === -1)
+        return null;
+    return { username: decoded.slice(0, i), password: decoded.slice(i + 1) };
+}
+// The vault has to be loadable before any credential means anything.
+function vaultOf(root, verb) {
+    const state = (0, vault_1.loadVault)(root);
+    if (state.status === 'missing') {
+        return {
+            ok: false,
+            status: 401,
+            message: `${verb} denied: no vault.json in this vault; restart the server to initialize one`,
+        };
+    }
+    if (state.status === 'error') {
+        return { ok: false, status: 500, message: `${verb} denied: vault.json could not be read: ${state.message}` };
+    }
+    return { vault: state.vault };
+}
+function checkCreds(root, limiter, req, verb) {
+    const v = vaultOf(root, verb);
+    if ('ok' in v)
+        return v;
+    // git's first request carries no Basic auth by protocol and always will, so
+    // a missing credential is not a failed attempt and is not charged.
+    const creds = parseBasicAuth(req);
+    if (!creds) {
+        return { ok: false, status: 401, message: `authentication required to ${verb}` };
+    }
+    const allowed = limiter.allow(req, creds.username);
+    if (!allowed.ok) {
+        return {
+            ok: false,
+            status: 429,
+            message: 'too many failed authentication attempts; try again later',
+            retryAfter: allowed.retryAfter,
+        };
+    }
+    // The username first, and the token alone as the fallback: a token is 64
+    // random hex characters and identifies its owner by itself, so any username
+    // with a valid token works, as it does on GitHub. That is what lets a
+    // client that holds only a token (the backup client, a script) clone
+    // without also being told whose it is.
+    const auth = (0, vault_1.authenticate)(v.vault, creds.username, creds.password) ?? (0, vault_1.authenticateToken)(v.vault, creds.password);
+    if (!auth) {
+        limiter.fail(req, creds.username);
+        return { ok: false, status: 401, message: 'invalid username or token' };
+    }
+    return { auth };
+}
+/**
+ * Whether this request may read the repository over git. A public repository
+ * reads anonymously. A private one and an absent one answer identically, so
+ * the wire cannot distinguish them: no credential gets the 401 challenge
+ * (which is also what makes git ask the user for one), and a credential that
+ * proves no read access gets the same "repository not found" a truly absent
+ * repository gets. A workflow job's ephemeral token (src/jobtoken.ts) reads
+ * exactly the repository it was minted for.
+ */
+function checkReadAuth(root, limiter, req, repo) {
+    if (repo && !(0, perms_1.repoIsPrivate)(repo.dir))
+        return { ok: true, auth: null };
+    const creds = parseBasicAuth(req);
+    if (repo && creds) {
+        const grant = (0, jobtoken_1.verifyJobToken)(root, creds.password);
+        if (grant && (0, jobtoken_1.grantCovers)(grant, repo.collection, repo.name))
+            return { ok: true, auth: null };
+    }
+    const checked = checkCreds(root, limiter, req, 'read');
+    if ('ok' in checked)
+        return checked;
+    if (!repo || !(0, perms_1.canReadRepo)(root, checked.auth, repo)) {
+        return { ok: false, status: 404, message: 'repository not found' };
+    }
+    return { ok: true, auth: checked.auth };
+}
+/**
+ * Whether this request may push. `repo` is null for push-to-create, where the
+ * question is creation in the collection rather than the write role on an
+ * existing repository. On an existing private repository a credential without
+ * even the read role gets "repository not found", as on the read path.
+ */
+function checkPushAuth(root, limiter, req, collection, repoName, repo) {
+    const checked = checkCreds(root, limiter, req, 'push');
+    if ('ok' in checked)
+        return checked;
+    const auth = checked.auth;
+    if (repo) {
+        const role = (0, perms_1.repoRole)(root, auth, repo);
+        if (role === null)
+            return { ok: false, status: 404, message: 'repository not found' };
+        if (!(0, perms_1.atLeast)(role, 'write')) {
+            return {
+                ok: false,
+                status: 403,
+                message: `user ${auth.username} is not allowed to push to ${collection}/${repoName}`,
+            };
+        }
+        return { ok: true, auth };
+    }
+    if (!(0, perms_1.canCreateRepo)(root, auth, collection, repoName)) {
+        return {
+            ok: false,
+            status: 403,
+            message: `user ${auth.username} is not allowed to create ${collection}/${repoName}`,
+        };
+    }
+    return { ok: true, auth };
+}
+// The refs a push may have changed, read before and after receive-pack. A
+// snapshot diff rather than a post-receive hook script: it needs no hook
+// installed in each repository, so it works for repositories imported by
+// `git clone --bare` as well as ones this server created.
+async function refSnapshot(repo) {
+    const snap = new Map();
+    try {
+        const out = (await (0, git_1.execGit)(repo.dir, ['for-each-ref', '--format=%(refname)%00%(objectname)', 'refs/heads', 'refs/tags'])).toString('utf8');
+        for (const line of out.split('\n')) {
+            if (!line)
+                continue;
+            const [name, sha] = line.split('\0');
+            if (name && sha)
+                snap.set(name, sha);
+        }
+    }
+    catch {
+        // an unreadable ref list yields no events rather than failing the push
+    }
+    return snap;
+}
+const ZERO = '0'.repeat(40);
+function registerGitHttp(app, root, gates, authLimiter, engine) {
+    // git shows the body of a 503 on the RPC to the person who ran the command, so
+    // it is one sentence. Not 429: this is server capacity rather than a client
+    // quota, and git's own error surface reads better with 503.
+    function denyBusy(res) {
+        res.status(503).setHeader('Retry-After', String(limit_1.BUSY_RETRY_SECONDS));
+        res.type('text/plain').send('the server is busy with other git work; please try again in a moment\n');
+    }
+    function deny(res, status, message, retryAfter) {
+        if (status === 401)
+            res.setHeader('WWW-Authenticate', 'Basic realm="mochi"');
+        if (retryAfter !== undefined)
+            res.setHeader('Retry-After', String(retryAfter));
+        res.status(status).type('text/plain').send(message + '\n');
+    }
+    function requirePushAuth(req, res, collection, repoName, repo) {
+        const check = checkPushAuth(root, authLimiter, req, collection, repoName, repo);
+        if (!check.ok) {
+            deny(res, check.status, check.message, check.retryAfter);
+            return null;
+        }
+        return check.auth;
+    }
+    /** The repository, readable by this request, or null having sent the refusal. */
+    function requireReadAuth(req, res) {
+        const repo = (0, scan_1.findRepo)(root, req.params.collection, req.params.repo);
+        const check = checkReadAuth(root, authLimiter, req, repo);
+        if (!check.ok) {
+            deny(res, check.status, check.message, check.retryAfter);
+            return null;
+        }
+        if (!repo) {
+            // Unreachable: checkReadAuth answers ok only for a repository it saw.
+            deny(res, 404, 'repository not found');
+            return null;
+        }
+        return repo;
+    }
+    async function ensureHead(repo) {
+        const branches = await repo.listRefs('heads');
+        if (branches.length === 0)
+            return;
+        try {
+            const head = (await (0, git_1.execGit)(repo.dir, ['symbolic-ref', '--short', 'HEAD'])).toString('utf8').trim();
+            if (branches.some((b) => b.name === head))
+                return;
+        }
+        catch {
+            // detached or unreadable HEAD; repoint below
+        }
+        const names = branches.map((b) => b.name).sort();
+        const pick = names.includes('main') ? 'main' : names.includes('master') ? 'master' : names[0];
+        await (0, git_1.execGit)(repo.dir, ['symbolic-ref', 'HEAD', `refs/heads/${pick}`]);
+    }
+    // Both of these spawn git, and both hold their gate slot until the child is
+    // gone rather than until the handler returns: runService pipes and returns
+    // immediately, so releasing on return would bound nothing at all. The gate's
+    // release is idempotent, which is what lets it be wired to both the child
+    // closing and the response closing; an aborted clone is ordinary traffic, and
+    // a gate that leaked a slot per abort would stop answering after four of them.
+    function gateFor(service) {
+        return service === 'git-upload-pack' ? gates.clone : gates.push;
+    }
+    async function advertise(req, res, service, dir) {
+        const release = await gateFor(service).enter();
+        if (!release) {
+            denyBusy(res);
+            return;
+        }
+        res.on('close', release);
+        res.setHeader('Content-Type', `application/x-${service}-advertisement`);
+        res.setHeader('Cache-Control', 'no-cache');
+        res.write(pkt(`# service=${service}\n`) + '0000');
+        const child = (0, child_process_1.spawn)('git', [service.slice(4), '--stateless-rpc', '--advertise-refs', dir], {
+            env: gitEnv(req),
+        });
+        child.on('close', release);
+        child.stdout.pipe(res);
+        child.on('error', () => {
+            release();
+            res.end();
+        });
+    }
+    async function runService(req, res, service, dir, onClose) {
+        const release = await gateFor(service).enter();
+        if (!release) {
+            denyBusy(res);
+            return;
+        }
+        res.on('close', release);
+        res.setHeader('Content-Type', `application/x-${service}-result`);
+        res.setHeader('Cache-Control', 'no-cache');
+        const child = (0, child_process_1.spawn)('git', [service.slice(4), '--stateless-rpc', dir], { env: gitEnv(req) });
+        let body = req;
+        if (req.headers['content-encoding'] === 'gzip') {
+            body = req.pipe(zlib.createGunzip());
+        }
+        body.pipe(child.stdin);
+        child.stdout.pipe(res);
+        child.on('error', () => {
+            release();
+            res.status(500).end();
+        });
+        child.on('close', (code) => {
+            release();
+            if (onClose)
+                onClose(code);
+        });
+    }
+    app.get('/:collection/:repo/info/refs', (0, web_1.ah)(async (req, res) => {
+        const service = req.query.service;
+        const collectionName = req.params.collection;
+        const repoName = (0, scan_1.displayName)(req.params.repo);
+        if (service === 'git-upload-pack') {
+            const repo = requireReadAuth(req, res);
+            if (!repo)
+                return;
+            await advertise(req, res, 'git-upload-pack', repo.dir);
+            return;
+        }
+        if (service === 'git-receive-pack') {
+            if (!(0, scan_1.isValidName)(collectionName) || !(0, scan_1.isValidName)(repoName)) {
+                res.status(404).type('text/plain').send('invalid repository name\n');
+                return;
+            }
+            let repo = (0, scan_1.findRepo)(root, collectionName, req.params.repo);
+            const auth = requirePushAuth(req, res, collectionName, repoName, repo);
+            if (!auth)
+                return;
+            if (!repo) {
+                // Push-to-create, so the name has to survive the same check the web
+                // form applies. An existing repository is served whatever it is
+                // called; only a new one is refused.
+                const reserved = (0, scan_1.reservedRepoSuffix)(repoName);
+                if (reserved) {
+                    res
+                        .status(400)
+                        .type('text/plain')
+                        .send(`repository names may not end in ${reserved}, which is reserved for the directories a repository keeps beside it\n`);
+                    return;
+                }
+                // A push creates the collection too when it does not exist, and only
+                // a repository may carry a leading dot.
+                if ((0, scan_1.isDotName)(collectionName)) {
+                    res.status(400).type('text/plain').send('collection names may not begin with a dot\n');
+                    return;
+                }
+                repo = await (0, ops_1.createRepo)(root, collectionName, repoName);
+            }
+            await advertise(req, res, 'git-receive-pack', repo.dir);
+            return;
+        }
+        res.status(403).type('text/plain').send('unsupported service\n');
+    }));
+    app.post('/:collection/:repo/git-upload-pack', (0, web_1.ah)(async (req, res) => {
+        const repo = requireReadAuth(req, res);
+        if (!repo)
+            return;
+        // The gate is entered after the read check and before anything expensive.
+        await runService(req, res, 'git-upload-pack', repo.dir);
+    }));
+    app.post('/:collection/:repo/git-receive-pack', (0, web_1.ah)(async (req, res) => {
+        const collectionName = req.params.collection;
+        const repoName = (0, scan_1.displayName)(req.params.repo);
+        if (!(0, scan_1.isValidName)(collectionName) || !(0, scan_1.isValidName)(repoName)) {
+            res.status(404).type('text/plain').send('invalid repository name\n');
+            return;
+        }
+        let repo = (0, scan_1.findRepo)(root, collectionName, req.params.repo);
+        const auth = requirePushAuth(req, res, collectionName, repoName, repo);
+        if (!auth)
+            return;
+        if (!repo) {
+            const reserved = (0, scan_1.reservedRepoSuffix)(repoName);
+            if (reserved) {
+                res
+                    .status(400)
+                    .type('text/plain')
+                    .send(`repository names may not end in ${reserved}, which is reserved for the directories a repository keeps beside it\n`);
+                return;
+            }
+            if ((0, scan_1.isDotName)(collectionName)) {
+                res.status(400).type('text/plain').send('collection names may not begin with a dot\n');
+                return;
+            }
+            repo = await (0, ops_1.createRepo)(root, collectionName, repoName);
+        }
+        const target = repo;
+        const actor = auth.username;
+        const before = await refSnapshot(target);
+        // The push gate is entered only now, after requirePushAuth has succeeded:
+        // an unauthenticated request must not be able to occupy a slot that
+        // authorized users depend on.
+        await runService(req, res, 'git-receive-pack', repo.dir, (code) => {
+            if (code !== 0)
+                return;
+            ensureHead(target)
+                .then(() => (engine ? firePushEvents(engine, target, before, actor) : undefined))
+                .catch((e) => console.error(`post-receive handling failed: ${e instanceof Error ? e.message : e}`));
+        });
+    }));
+}
+// Turn a before/after ref snapshot into push events for the CI engine. Ref
+// deletions are reported (with an all-zero "after") and ignored downstream;
+// a workflow file that fails to parse still produces a visible failed run,
+// which is why nothing here filters on content.
+async function firePushEvents(engine, repo, before, actor) {
+    const after = await refSnapshot(repo);
+    for (const [ref, sha] of after) {
+        if (before.get(ref) === sha)
+            continue;
+        await engine.handlePush(repo, { ref, before: before.get(ref) ?? ZERO, after: sha, actor });
+    }
+}

package/dist/html.js

@@ -0,0 +1,87 @@
+"use strict";
+// HTML with escaping as the default rather than the discipline.
+//
+// Every page here is built from template literals, and for a long time each
+// interpolation escaped its own value by hand: `${esc(name)}`. The rule was
+// simple and the failure mode was simpler: one forgotten esc() is an
+// injection, and nothing but review stood between the two. This module turns
+// the rule into the type system. The html`` tag escapes every interpolated
+// value unless it is already Html, and a value is only Html because a
+// template built it or because raw() was told, in so many words, to trust it.
+//
+// The composition rule falls out of the type: a fragment built by html`` can
+// be interpolated into another html`` template and is not escaped again, so
+// pages nest the way they always did, and the only places that need a
+// decision are the borders where pre-rendered HTML comes in from elsewhere --
+// markdown output, highlighted code, a diff -- which is exactly where the
+// decision belongs.
+//
+// One trap is worth naming. An array of Html fragments interpolates
+// correctly, joined by nothing, but calling .join() on one produces a plain
+// string, which the tag then escapes: `${items.join('\n')}` is the bug and
+// `${joinHtml(items, '\n')}` is the spelling. The type system cannot refuse
+// .join on an array, so this is the one place the old discipline survives.
+//
+// Where escaping is checked: layout() takes Html and nothing else, so a page
+// cannot be assembled from a plain string at all, and tests/escaping.test.ts
+// drives the real page functions with a script tag and an attribute break
+// where a name, a path, or a description goes. What it asserts is both halves:
+// that nothing executable comes out, and that the payload reached the page, so
+// a test cannot pass by rendering nothing.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Html = void 0;
+exports.esc = esc;
+exports.raw = raw;
+exports.html = html;
+exports.joinHtml = joinHtml;
+function esc(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/** A string of HTML that is what it says it is, and may be interpolated without escaping. */
+class Html {
+    text;
+    constructor(text) {
+        this.text = text;
+    }
+    toString() {
+        return this.text;
+    }
+}
+exports.Html = Html;
+/**
+ * Trust a string as HTML. This is the whole of the escape hatch, and the name
+ * is a flag for review: every raw() should be able to say where its argument
+ * was made safe.
+ */
+function raw(text) {
+    return new Html(text);
+}
+function render(v) {
+    if (v instanceof Html)
+        return v.text;
+    if (Array.isArray(v))
+        return v.map(render).join('');
+    // Dropping the non-values is what makes `${cond && fragment}` a
+    // conditional and `${maybe?.thing}` an optional, without either spelling
+    // out an empty-string alternative.
+    if (v === null || v === undefined || typeof v === 'boolean')
+        return '';
+    return esc(String(v));
+}
+/** The tag. Literal text passes through; every value is escaped unless it is Html. */
+function html(strings, ...values) {
+    let out = strings[0];
+    for (let i = 0; i < values.length; i++) {
+        out += render(values[i]) + strings[i + 1];
+    }
+    return new Html(out);
+}
+/** Fragments joined by a literal separator, since Array.prototype.join would flatten them to escaped text. */
+function joinHtml(items, separator = '') {
+    return new Html(items.map(render).join(separator));
+}

package/dist/icons.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.icon = icon;
+const html_1 = require("./html");
+// The icon set: drawn here, in the same language as the logo.
+//
+// mochi ships no static files, so an icon is a string of SVG markup rather
+// than a sprite sheet or a font. Each entry below is the interior of one glyph
+// on a 24-unit grid. The wrapper is added by icon() so every icon carries the
+// same box, the same class, and the same accessibility treatment.
+//
+// The drawings are monoline: a constant stroke of 2 units with round caps and
+// joins, no fills except where a shape has to read as solid at 16 pixels (the
+// dot in an open issue, the three dots of a menu). This is the construction
+// the mark and the logotype use, so the interface and the brand are one
+// drawing rather than two. It is also why the shapes are built from circles,
+// arcs, and straight runs, and why nothing here is an outline of a filled
+// form: an outline would need a second weight, and there is only one.
+//
+// The grid is 24 while the box is 16, which gives half-unit positions at the
+// rendered size without fractional coordinates in the source. Strokes are kept
+// two units clear of the edges so a round cap is never cut by the viewBox.
+//
+// Icons take their colour from the surrounding text (stroke="currentColor"),
+// which is what lets them sit inside links, buttons, and muted labels without
+// a per-theme variant. Where a different colour is wanted, pass a class and
+// give that class a colour token in style.ts.
+const DOT = (cx, cy, r = 1.6) => `<circle cx="${cx}" cy="${cy}" r="${r}" fill="currentColor" stroke="none"/>`;
+const PATHS = {
+    // Marks and arrows.
+    check: '<path d="M4.5 12.5 9.5 17.5 19.5 6.5"/>',
+    x: '<path d="M6 6 18 18M18 6 6 18"/>',
+    plus: '<path d="M12 4.5V19.5M4.5 12H19.5"/>',
+    'chevron-down': '<path d="M6 9.5 12 15.5 18 9.5"/>',
+    circle: '<circle cx="12" cy="12" r="9"/>',
+    dot: `<circle cx="12" cy="12" r="9"/>${DOT(12, 12, 3.2)}`,
+    'check-circle': '<circle cx="12" cy="12" r="9"/><path d="M7.5 12.2 10.6 15.3 16.5 9.2"/>',
+    'x-circle': '<circle cx="12" cy="12" r="9"/><path d="M8.8 8.8 15.2 15.2M15.2 8.8 8.8 15.2"/>',
+    alert: `<path d="M10.3 3.9a2 2 0 0 1 3.4 0l7.5 13a2 2 0 0 1-1.7 3H4.5a2 2 0 0 1-1.7-3Z"/><path d="M12 9.5V14"/>${DOT(12, 17.3, 1.2)}`,
+    skip: '<circle cx="12" cy="12" r="9"/><path d="M8 12H16"/>',
+    stop: '<circle cx="12" cy="12" r="9"/><path d="M5.6 18.4 18.4 5.6"/>',
+    play: '<circle cx="12" cy="12" r="9"/><path d="M10 8.4 16 12 10 15.6Z"/>',
+    clock: '<circle cx="12" cy="12" r="9"/><path d="M12 6.8V12L15.6 14.1"/>',
+    sync: '<path d="M12 3.5a8.5 8.5 0 1 1-8.5 8.5"/><path d="M1.9 14.6 3.5 12 5.1 14.6"/>',
+    kebab: `${DOT(5, 12)}${DOT(12, 12)}${DOT(19, 12)}`,
+    // Repositories and their contents.
+    repo: '<rect x="4" y="3" width="16" height="18" rx="2.5"/><path d="M8.5 3V21"/>',
+    'repo-forked': '<circle cx="6" cy="5" r="2.5"/><circle cx="18" cy="5" r="2.5"/><circle cx="12" cy="19" r="2.5"/><path d="M6 7.5v1.5a3 3 0 0 0 3 3h6a3 3 0 0 0 3-3V7.5M12 12v4.5"/>',
+    book: '<path d="M2.5 4.5h5.5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5.5v12H16a4 4 0 0 0-4 4 4 4 0 0 0-4-4H2.5Z"/><path d="M12 8.5v12"/>',
+    file: '<path d="M13.5 3H7a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V8.5Z"/><path d="M13.5 3v5.5H19"/>',
+    'file-zip': '<path d="M13.5 3H7a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V8.5Z"/><path d="M13.5 3v5.5H19"/><path d="M9 6.5h1.5M9 10h1.5M9 13.5h1.5"/>',
+    folder: '<path d="M3 19.5V6.5A1.5 1.5 0 0 1 4.5 5h4.1a1.5 1.5 0 0 1 1.2.6l1.3 1.8a1.5 1.5 0 0 0 1.2.6h7.2A1.5 1.5 0 0 1 21 9.5v10A1.5 1.5 0 0 1 19.5 21h-15A1.5 1.5 0 0 1 3 19.5Z"/>',
+    code: '<path d="M8.5 6 3.5 12 8.5 18M15.5 6 20.5 12 15.5 18"/>',
+    versions: '<rect x="9" y="3" width="12" height="18" rx="2"/><path d="M6 5.5V18.5M3 8V16"/>',
+    package: '<path d="M3.2 7.2 12 2.4l8.8 4.8v9.6L12 21.6l-8.8-4.8Z"/><path d="M3.2 7.2 12 12l8.8-4.8M12 12v9.6"/>',
+    tag: '<path d="M13.6 3.6A2 2 0 0 0 12.2 3H5a2 2 0 0 0-2 2v7.2a2 2 0 0 0 .6 1.4l7.2 7.2a2 2 0 0 0 2.8 0l7.2-7.2a2 2 0 0 0 0-2.8Z"/><circle cx="7.6" cy="7.6" r="1.4"/>',
+    law: '<path d="M12 4V21M8 21h8M4.5 7.5 12 6l7.5 1.5"/><path d="M4.5 7.5 2 13a2.5 2.5 0 0 0 5 0Z"/><path d="M19.5 7.5 17 13a2.5 2.5 0 0 0 5 0Z"/>',
+    // The git graph.
+    'git-commit': '<circle cx="12" cy="12" r="3.6"/><path d="M2.5 12h5.9M15.6 12h5.9"/>',
+    'git-branch': '<circle cx="6" cy="18.5" r="2.5"/><circle cx="18" cy="6" r="2.5"/><path d="M6 16V3M18 8.5a9.5 9.5 0 0 1-9.5 9.5H8"/>',
+    'git-merge': '<circle cx="6" cy="5.5" r="2.5"/><circle cx="18" cy="18.5" r="2.5"/><path d="M6 8v13.5M6 10a8.5 8.5 0 0 0 8.5 8.5h1"/>',
+    'git-pull-request': '<circle cx="6" cy="5.5" r="2.5"/><circle cx="18" cy="18.5" r="2.5"/><path d="M6 8v13.5"/><path d="M13 5.5h2.5A2.5 2.5 0 0 1 18 8v8"/><path d="M15.5 3 13 5.5 15.5 8"/>',
+    'git-pull-request-closed': '<circle cx="6" cy="5.5" r="2.5"/><circle cx="18" cy="18.5" r="2.5"/><path d="M6 8v13.5"/><path d="M18 16v-4.5"/><path d="M15 4 21 10M21 4 15 10"/>',
+    'git-compare': '<path d="M4 19.5V8.5A2.5 2.5 0 0 1 6.5 6H14"/><path d="M11.5 3.5 14 6 11.5 8.5"/><path d="M20 4.5v11a2.5 2.5 0 0 1-2.5 2.5H10"/><path d="M12.5 15.5 10 18 12.5 20.5"/>',
+    history: `<path d="M5.5 7.5v3M5.5 13.5v3"/>${DOT(5.5, 5.5, 2)}${DOT(5.5, 12, 2)}${DOT(5.5, 18.5, 2)}<path d="M11 5.5h9.5M11 12h9.5M11 18.5h6"/>`,
+    // Issues, pulls, and talk.
+    'issue-opened': `<circle cx="12" cy="12" r="9"/>${DOT(12, 12, 2.2)}`,
+    'issue-closed': '<circle cx="12" cy="12" r="9"/><path d="M7.5 12.2 10.6 15.3 16.5 9.2"/>',
+    comment: '<path d="M4.5 21V6.5A2.5 2.5 0 0 1 7 4h10A2.5 2.5 0 0 1 19.5 6.5v8A2.5 2.5 0 0 1 17 17H8.5Z"/>',
+    filter: '<path d="M3.5 6.5h17M6.5 12h11M10 17.5h4"/>',
+    search: '<circle cx="10.5" cy="10.5" r="6.5"/><path d="M15.2 15.2 20.5 20.5"/>',
+    link: '<path d="M9.5 14.5 14.5 9.5"/><path d="M10.5 6.6 12.3 4.8a4.5 4.5 0 0 1 6.4 6.4l-1.8 1.8"/><path d="M13.5 17.4 11.7 19.2a4.5 4.5 0 0 1-6.4-6.4l1.8-1.8"/>',
+    // People.
+    person: '<circle cx="12" cy="8" r="3.6"/><path d="M4.5 20.5a7.5 7.5 0 0 1 15 0"/>',
+    people: '<circle cx="8.6" cy="8" r="3.2"/><circle cx="17" cy="8.8" r="2.4"/><path d="M2.6 19.5a6 6 0 0 1 12 0"/><path d="M16.2 14.2a5.6 5.6 0 0 1 5.2 5.3"/>',
+    // Actions and places.
+    pencil: '<path d="M4 20h4L19 9a2.83 2.83 0 0 0-4-4L4 16Z"/><path d="M14.5 6.5 17.5 9.5"/>',
+    trash: '<path d="M4 6.5h16"/><path d="M9.5 6.5V4.8A1.8 1.8 0 0 1 11.3 3h1.4a1.8 1.8 0 0 1 1.8 1.8V6.5"/><path d="M6.5 6.5 7.4 19.1A2 2 0 0 0 9.4 21h5.2a2 2 0 0 0 2-1.9L17.5 6.5"/><path d="M10 10.5V17M14 10.5V17"/>',
+    copy: '<rect x="8" y="8" width="13" height="13" rx="2.5"/><path d="M16 5.5A2.5 2.5 0 0 0 13.5 3h-8A2.5 2.5 0 0 0 3 5.5v8A2.5 2.5 0 0 0 5.5 16"/>',
+    download: '<path d="M12 3.5V15.5M7 10.5 12 15.5 17 10.5"/><path d="M4 17v2a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-2"/>',
+    upload: '<path d="M12 15.5V3.5M7 8.5 12 3.5 17 8.5"/><path d="M4 17v2a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-2"/>',
+    'sign-out': '<path d="M15 4.5H6.5A1.5 1.5 0 0 0 5 6v12a1.5 1.5 0 0 0 1.5 1.5H15"/><path d="M11 12h10M17.5 8.5 21 12 17.5 15.5"/>',
+    sliders: '<path d="M3.5 6.5h9M16.5 6.5h4M3.5 12h3M10.5 12h10M3.5 17.5h9M16.5 17.5h4"/><circle cx="14.5" cy="6.5" r="2"/><circle cx="8.5" cy="12" r="2"/><circle cx="14.5" cy="17.5" r="2"/>',
+    appearance: '<circle cx="12" cy="12" r="9"/><path d="M12 3a9 9 0 0 1 0 18Z" fill="currentColor" stroke="none"/>',
+    globe: '<circle cx="12" cy="12" r="9"/><path d="M3.3 9h17.4M3.3 15h17.4"/><path d="M12 3c2.4 2.5 3.7 5.6 3.7 9s-1.3 6.5-3.7 9c-2.4-2.5-3.7-5.6-3.7-9S9.6 5.5 12 3Z"/>',
+    server: `<rect x="3" y="4" width="18" height="7" rx="2"/><rect x="3" y="13" width="18" height="7" rx="2"/>${DOT(7, 7.5, 1.2)}${DOT(7, 16.5, 1.2)}`,
+    workflow: '<rect x="3" y="3" width="7" height="7" rx="1.5"/><rect x="14" y="14" width="7" height="7" rx="1.5"/><path d="M6.5 10v4.5a3 3 0 0 0 3 3H14"/>',
+    rocket: '<path d="M12 2.5c2.6 2.6 4 5.9 4 9.5v3.5H8V12c0-3.6 1.4-6.9 4-9.5Z"/><circle cx="12" cy="9.8" r="1.7"/><path d="M8 12.6 5.2 15.4a2 2 0 0 0-.6 1.4V19l3.4-2M16 12.6l2.8 2.8a2 2 0 0 1 .6 1.4V19l-3.4-2"/><path d="M10.3 19c.3 1.1.9 2.1 1.7 2.9.8-.8 1.4-1.8 1.7-2.9"/>',
+    rss: `<path d="M4 11.5a8.5 8.5 0 0 1 8.5 8.5M4 4.5A15.5 15.5 0 0 1 19.5 20"/>${DOT(5, 19, 1.7)}`,
+};
+/**
+ * One icon as inline SVG. Icons are decorative next to a label, so they are
+ * hidden from assistive technology; where an icon stands alone (an icon-only
+ * button, say) the caller labels the control instead.
+ */
+function icon(name, cls = '') {
+    const body = PATHS[name];
+    if (!body)
+        throw new Error(`unknown icon: ${name}`);
+    return (0, html_1.raw)(`<svg class="glyph${cls ? ` ${cls}` : ''}" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${body}</svg>`);
+}