@magland/mochi 0.3.1

package/dist/api/issues.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerIssueApi = registerIssueApi;
+const issues_1 = require("../issues");
+const auth_1 = require("./auth");
+// Issues. The domain functions in src/issues.ts do all of the work; this is a
+// transport over them, and the response objects are the IssueSummary and Issue
+// interfaces unchanged, so a field added to an issue's state appears here without
+// a decision being made about it.
+//
+// Who the author is comes from the bearer token, never from the body, on any
+// route, ever. Reading an issue takes any valid token; writing one takes push
+// scope over the repository, which is the same rule the web applies.
+const MAX_LISTED = 500;
+function issueNumber(raw) {
+    return /^[1-9][0-9]*$/.test(raw ?? '') ? parseInt(raw, 10) : null;
+}
+function registerIssueApi(app, root, limiter) {
+    // The labels route is registered before :n so that /issues/labels is not read
+    // as issue number "labels".
+    app.get('/api/repos/:collection/:repo/issues/labels', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const all = (0, issues_1.listIssues)(root, found.repo.collection, found.repo.name);
+        res.json({ labels: (0, issues_1.labelsInUse)(all), authors: (0, issues_1.authorsInUse)(all) });
+    });
+    app.get('/api/repos/:collection/:repo/issues', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const stateAsked = String(req.query.state ?? 'open');
+        if (!['open', 'closed', 'all'].includes(stateAsked)) {
+            (0, auth_1.apiError)(res, 400, 'state must be open, closed, or all');
+            return;
+        }
+        const sortAsked = String(req.query.sort ?? 'newest');
+        if (!issues_1.ISSUE_SORTS.some((s) => s.key === sortAsked)) {
+            (0, auth_1.apiError)(res, 400, `sort must be one of: ${issues_1.ISSUE_SORTS.map((s) => s.key).join(', ')}`);
+            return;
+        }
+        const all = (0, issues_1.listIssues)(root, found.repo.collection, found.repo.name, {
+            match: String(req.query.q ?? '') || undefined,
+        });
+        const selected = (0, issues_1.selectIssues)(all, {
+            state: stateAsked,
+            label: String(req.query.label ?? '') || undefined,
+            author: String(req.query.author ?? '') || undefined,
+            sort: sortAsked,
+        });
+        const limit = (0, auth_1.limitParam)(req.query.limit, MAX_LISTED, MAX_LISTED);
+        res.json({ issues: selected.slice(0, limit), total: selected.length });
+    });
+    app.get('/api/repos/:collection/:repo/issues/:n', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = issueNumber(req.params.n);
+        const issue = n === null ? null : (0, issues_1.readIssue)(root, found.repo.collection, found.repo.name, n);
+        if (!issue) {
+            (0, auth_1.apiError)(res, 404, `no issue ${req.params.n} in ${found.repo.collection}/${found.repo.name}`);
+            return;
+        }
+        res.json(issue);
+    });
+    app.post('/api/repos/:collection/:repo/issues', (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const body = (0, auth_1.bodyOf)(req);
+        const title = (0, auth_1.stringField)(body, 'title');
+        if (title === null) {
+            (0, auth_1.apiError)(res, 400, 'a "title" is required');
+            return;
+        }
+        const labels = (0, auth_1.stringsField)(body, 'labels');
+        if (labels === null) {
+            (0, auth_1.apiError)(res, 400, '"labels" must be a list of strings');
+            return;
+        }
+        try {
+            // The author is the token's user. No author field is read from the body.
+            const created = (0, issues_1.createIssue)(root, found.repo.collection, found.repo.name, {
+                title,
+                body: (0, auth_1.stringField)(body, 'body') ?? '',
+                author: found.actor.username,
+                labels,
+            });
+            res.status(201).json(created);
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not create the issue');
+        }
+    });
+    app.patch('/api/repos/:collection/:repo/issues/:n', (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = issueNumber(req.params.n);
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no issue ${req.params.n}`);
+            return;
+        }
+        const body = (0, auth_1.bodyOf)(req);
+        const labels = (0, auth_1.stringsField)(body, 'labels');
+        if (labels === null) {
+            (0, auth_1.apiError)(res, 400, '"labels" must be a list of strings');
+            return;
+        }
+        try {
+            (0, issues_1.editIssue)(root, found.repo.collection, found.repo.name, n, {
+                title: (0, auth_1.stringField)(body, 'title') ?? undefined,
+                body: (0, auth_1.stringField)(body, 'body') ?? undefined,
+                labels,
+            });
+            res.json((0, issues_1.readIssue)(root, found.repo.collection, found.repo.name, n));
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not edit the issue');
+        }
+    });
+    app.post('/api/repos/:collection/:repo/issues/:n/comments', (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = issueNumber(req.params.n);
+        const text = (0, auth_1.stringField)((0, auth_1.bodyOf)(req), 'body');
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no issue ${req.params.n}`);
+            return;
+        }
+        if (text === null) {
+            (0, auth_1.apiError)(res, 400, 'a "body" is required');
+            return;
+        }
+        try {
+            res.status(201).json((0, issues_1.addComment)(root, found.repo.collection, found.repo.name, n, { author: found.actor.username, body: text }));
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not add the comment');
+        }
+    });
+    app.post('/api/repos/:collection/:repo/issues/:n/state', (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = issueNumber(req.params.n);
+        const state = (0, auth_1.stringField)((0, auth_1.bodyOf)(req), 'state');
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no issue ${req.params.n}`);
+            return;
+        }
+        if (state !== 'open' && state !== 'closed') {
+            (0, auth_1.apiError)(res, 400, '"state" must be "open" or "closed"');
+            return;
+        }
+        try {
+            (0, issues_1.setIssueState)(root, found.repo.collection, found.repo.name, n, state, found.actor.username);
+            res.json((0, issues_1.readIssue)(root, found.repo.collection, found.repo.name, n));
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not change the state');
+        }
+    });
+}

package/dist/api/pulls.js

@@ -0,0 +1,244 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPullApi = registerPullApi;
+const trigger_1 = require("../ci/trigger");
+const git_1 = require("../git");
+const ops_1 = require("../ops");
+const pulls_1 = require("../pulls");
+const auth_1 = require("./auth");
+// Pull requests. The interesting route here is GET .../merge, which answers "will
+// this apply" without writing anything: an agent that reads, thinks, and proposes
+// wants to know before it asks. POST .../merge goes through pulls.mergePull, the
+// same sequence the web merge button performs.
+const MAX_LISTED = 500;
+function pullNumber(raw) {
+    return /^[1-9][0-9]*$/.test(raw ?? '') ? parseInt(raw, 10) : null;
+}
+function registerPullApi(app, root, limiter, engine) {
+    app.get('/api/repos/:collection/:repo/pulls', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const stateAsked = String(req.query.state ?? 'open');
+        if (!['open', 'closed', 'merged', 'all'].includes(stateAsked)) {
+            (0, auth_1.apiError)(res, 400, 'state must be open, closed, merged, or all');
+            return;
+        }
+        const all = (0, pulls_1.listPulls)(root, found.repo.collection, found.repo.name);
+        const selected = stateAsked === 'all' ? all : all.filter((p) => p.state === stateAsked);
+        const limit = (0, auth_1.limitParam)(req.query.limit, MAX_LISTED, MAX_LISTED);
+        res.json({ pulls: selected.slice(0, limit), total: selected.length });
+    });
+    app.get('/api/repos/:collection/:repo/pulls/:n', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        const pull = n === null ? null : (0, pulls_1.readPull)(root, found.repo.collection, found.repo.name, n);
+        if (!pull) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n} in ${found.repo.collection}/${found.repo.name}`);
+            return;
+        }
+        res.json(pull);
+    });
+    app.post('/api/repos/:collection/:repo/pulls', async (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const body = (0, auth_1.bodyOf)(req);
+        const title = (0, auth_1.stringField)(body, 'title');
+        const base = (0, auth_1.stringField)(body, 'base');
+        const head = (0, auth_1.stringField)(body, 'head');
+        if (title === null || base === null || head === null) {
+            (0, auth_1.apiError)(res, 400, '"title", "base", and "head" are required');
+            return;
+        }
+        const branches = (await found.repo.listRefs('heads')).map((b) => b.name);
+        try {
+            const created = (0, pulls_1.openPull)(root, found.repo.collection, found.repo.name, { title, body: (0, auth_1.stringField)(body, 'body') ?? '', author: found.actor.username, base, head }, branches);
+            res.status(201).json(created);
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not open the pull request');
+        }
+    });
+    app.patch('/api/repos/:collection/:repo/pulls/:n', (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n}`);
+            return;
+        }
+        const body = (0, auth_1.bodyOf)(req);
+        try {
+            (0, pulls_1.editPull)(root, found.repo.collection, found.repo.name, n, {
+                title: (0, auth_1.stringField)(body, 'title') ?? undefined,
+                body: (0, auth_1.stringField)(body, 'body') ?? undefined,
+            });
+            res.json((0, pulls_1.readPull)(root, found.repo.collection, found.repo.name, n));
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not edit the pull request');
+        }
+    });
+    app.post('/api/repos/:collection/:repo/pulls/:n/comments', (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        const text = (0, auth_1.stringField)((0, auth_1.bodyOf)(req), 'body');
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n}`);
+            return;
+        }
+        if (text === null) {
+            (0, auth_1.apiError)(res, 400, 'a "body" is required');
+            return;
+        }
+        try {
+            res.status(201).json((0, pulls_1.addComment)(root, found.repo.collection, found.repo.name, n, { author: found.actor.username, body: text }));
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not add the comment');
+        }
+    });
+    app.post('/api/repos/:collection/:repo/pulls/:n/state', (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        const state = (0, auth_1.stringField)((0, auth_1.bodyOf)(req), 'state');
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n}`);
+            return;
+        }
+        if (state !== 'open' && state !== 'closed') {
+            (0, auth_1.apiError)(res, 400, '"state" must be "open" or "closed"');
+            return;
+        }
+        try {
+            (0, pulls_1.setPullState)(root, found.repo.collection, found.repo.name, n, state, found.actor.username);
+            res.json((0, pulls_1.readPull)(root, found.repo.collection, found.repo.name, n));
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not change the state');
+        }
+    });
+    // The diff and the commits are questions for git, answered from base and head
+    // at the moment they are asked. A pull request never stores either.
+    const comparison = async (req, res, what) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        const pull = n === null ? null : (0, pulls_1.readPull)(root, found.repo.collection, found.repo.name, n);
+        if (!pull) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n}`);
+            return;
+        }
+        if (!(0, git_1.isValidRefName)(pull.base) || !(0, git_1.isValidRefName)(pull.head)) {
+            (0, auth_1.apiError)(res, 409, 'this pull request names a ref that is no longer usable');
+            return;
+        }
+        try {
+            const cmp = await found.repo.compare(pull.base, pull.head);
+            if (what === 'commits') {
+                res.json({ base: pull.base, head: pull.head, ahead: cmp.ahead, commits: cmp.commits });
+                return;
+            }
+            res.json({ base: pull.base, head: pull.head, ...cmp });
+        }
+        catch {
+            (0, auth_1.apiError)(res, 409, `could not compare ${pull.base} with ${pull.head}; one of them may be gone`);
+        }
+    };
+    app.get('/api/repos/:collection/:repo/pulls/:n/diff', (req, res) => comparison(req, res, 'diff'));
+    app.get('/api/repos/:collection/:repo/pulls/:n/commits', (req, res) => comparison(req, res, 'commits'));
+    // Mergeability without merging: the single most useful read for a caller that
+    // is about to write.
+    app.get('/api/repos/:collection/:repo/pulls/:n/merge', async (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        const pull = n === null ? null : (0, pulls_1.readPull)(root, found.repo.collection, found.repo.name, n);
+        if (!pull) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n}`);
+            return;
+        }
+        if (pull.state !== 'open') {
+            res.json({ state: pull.state, mergeable: false, status: pull.state });
+            return;
+        }
+        try {
+            const preview = await (0, ops_1.previewMerge)(found.repo.dir, pull.base, pull.head);
+            res.json({ state: pull.state, mergeable: preview.status === 'clean', ...preview });
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'the merge could not be computed');
+        }
+    });
+    app.post('/api/repos/:collection/:repo/pulls/:n/merge', async (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n}`);
+            return;
+        }
+        const body = (0, auth_1.bodyOf)(req);
+        const methodAsked = (0, auth_1.stringField)(body, 'method') ?? 'merge';
+        if (methodAsked !== 'merge' && methodAsked !== 'squash') {
+            (0, auth_1.apiError)(res, 400, '"method" must be "merge" or "squash"');
+            return;
+        }
+        const pull = (0, pulls_1.readPull)(root, found.repo.collection, found.repo.name, n);
+        const branches = await found.repo.listRefs('heads');
+        try {
+            const result = await (0, pulls_1.mergePull)(root, found.repo, n, found.actor, {
+                method: methodAsked,
+                message: (0, auth_1.stringField)(body, 'message') ?? undefined,
+                deleteBranch: body.deleteBranch === true,
+            }, { defaultBranch: await found.repo.defaultBranch(branches) });
+            // A merge moves a branch, which is a push as far as workflows are
+            // concerned. Forgetting this here would be a silent divergence from the
+            // web merge button, which fires it.
+            if (pull) {
+                (0, trigger_1.firePush)(root, engine, { collection: found.repo.collection, name: found.repo.name }, pull.base, result.before, result.sha, found.actor.username);
+            }
+            res.json(result);
+        }
+        catch (e) {
+            // A conflict is 409 with the conflicting paths, not a 400 and not a 500:
+            // the caller can act on the list.
+            if (e instanceof pulls_1.MergeConflict) {
+                res.status(409).json({ error: e.message, conflicts: e.paths });
+                return;
+            }
+            (0, auth_1.sendOpError)(res, e, 'the merge failed');
+        }
+    });
+    app.post('/api/repos/:collection/:repo/pulls/:n/delete-branch', async (req, res) => {
+        const found = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!found)
+            return;
+        const n = pullNumber(req.params.n);
+        if (n === null) {
+            (0, auth_1.apiError)(res, 404, `no pull request ${req.params.n}`);
+            return;
+        }
+        const branches = await found.repo.listRefs('heads');
+        try {
+            const deleted = await (0, pulls_1.deletePullBranch)(root, found.repo, n, {
+                defaultBranch: await found.repo.defaultBranch(branches),
+            });
+            res.json({ deleted });
+        }
+        catch (e) {
+            (0, auth_1.sendOpError)(res, e, 'could not delete the branch');
+        }
+    });
+}

package/dist/api/releases.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerReleaseApi = registerReleaseApi;
+const git_1 = require("../git");
+const releases_1 = require("../releases");
+const auth_1 = require("./auth");
+// Releases: notes attached to a tag.
+//
+// A release's downloads are the archive routes, so there is nothing to upload and
+// no asset endpoints. Anyone who knows `gh release upload` will look for one, and
+// docs/agents.md says plainly that it is not here.
+function registerReleaseApi(app, root, limiter) {
+    app.get('/api/repos/:collection/:repo/releases', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        res.json({ releases: (0, releases_1.listReleases)(root, found.repo.collection, found.repo.name) });
+    });
+    app.get('/api/repos/:collection/:repo/releases/:tag', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const tag = decodeURIComponent(req.params.tag);
+        const release = (0, releases_1.readRelease)(root, found.repo.collection, found.repo.name, tag);
+        if (!release) {
+            (0, auth_1.apiError)(res, 404, `no release for tag ${tag}`);
+            return;
+        }
+        res.json(release);
+    });
+    // PUT rather than POST, because a release is keyed by its tag and the file is
+    // one saveRelease either way. Creating and editing being the same call takes a
+    // whole class of "already exists, retry as an edit" logic out of the caller.
+    app.put('/api/repos/:collection/:repo/releases/:tag', async (req, res) => {
+        const ctx = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!ctx)
+            return;
+        const tag = decodeURIComponent(req.params.tag);
+        if (!(0, git_1.isValidRefName)(tag)) {
+            (0, auth_1.apiError)(res, 400, 'that is not a usable tag name');
+            return;
+        }
+        // The tag has to exist in the repository, which is what the web form checks:
+        // release notes for a tag nobody can check out are notes about nothing.
+        const tags = await ctx.repo.listRefs('tags');
+        if (!tags.some((t) => t.name === tag)) {
+            (0, auth_1.apiError)(res, 404, `no tag ${tag} in this repository; create the tag first`);
+            return;
+        }
+        const body = (0, auth_1.bodyOf)(req);
+        const existing = (0, releases_1.readRelease)(root, ctx.repo.collection, ctx.repo.name, tag);
+        const prerelease = body.prerelease;
+        if (prerelease !== undefined && typeof prerelease !== 'boolean') {
+            (0, auth_1.apiError)(res, 400, '"prerelease" must be true or false');
+            return;
+        }
+        const release = {
+            tag,
+            name: (0, auth_1.stringField)(body, 'name') ?? existing?.name ?? '',
+            // The author is whoever first published it, so an edit by someone else
+            // does not quietly reassign it.
+            author: existing?.author ?? ctx.actor.username,
+            created: existing?.created ?? new Date().toISOString(),
+            prerelease: prerelease ?? existing?.prerelease ?? false,
+            body: (0, auth_1.stringField)(body, 'body') ?? existing?.body ?? '',
+        };
+        (0, releases_1.saveRelease)(root, ctx.repo.collection, ctx.repo.name, release);
+        res.status(existing ? 200 : 201).json(release);
+    });
+    app.delete('/api/repos/:collection/:repo/releases/:tag', (req, res) => {
+        const ctx = (0, auth_1.requirePush)(root, limiter, req, res);
+        if (!ctx)
+            return;
+        const tag = decodeURIComponent(req.params.tag);
+        if (!(0, releases_1.deleteRelease)(root, ctx.repo.collection, ctx.repo.name, tag)) {
+            (0, auth_1.apiError)(res, 404, `no release for tag ${tag}`);
+            return;
+        }
+        // The tag itself is left alone: deleting release notes is not deleting a
+        // release's history, and the two are separate operations on purpose.
+        res.json({ deleted: tag, tagKept: true });
+    });
+}

package/dist/api/repos.js

@@ -0,0 +1,156 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRepoApi = registerRepoApi;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const layout_1 = require("../layout");
+const perms_1 = require("../perms");
+const scan_1 = require("../scan");
+const issues_1 = require("../issues");
+const pulls_1 = require("../pulls");
+const releases_1 = require("../releases");
+const auth_1 = require("./auth");
+function summarize(root, collection, dirName) {
+    const name = (0, scan_1.displayName)(dirName);
+    const dir = (0, layout_1.repoPath)(root, collection, dirName);
+    return {
+        collection,
+        name,
+        description: (0, scan_1.repoDescription)(dir) ?? '',
+        forkedFrom: (0, scan_1.forkParent)(dir),
+        hasSite: (0, scan_1.siteDir)(root, collection, name) !== null,
+        private: (0, perms_1.repoIsPrivate)(dir),
+    };
+}
+function registerRepoApi(app, root, limiter) {
+    // Every repository in the vault, flat. A vault's collections are small and
+    // this is read off disk per request, so there is no pagination: --limit and
+    // the server-side caps are enough, and a cursor protocol would be machinery
+    // with nothing to carry.
+    app.get('/api/repos', (req, res) => {
+        const auth = (0, auth_1.requireApiAuth)(root, limiter, req, res);
+        if (!auth)
+            return;
+        const repos = [];
+        for (const c of (0, scan_1.listCollections)(root)) {
+            for (const dirName of (0, scan_1.listRepoDirs)(root, c.name)) {
+                const dir = (0, layout_1.repoPath)(root, c.name, dirName);
+                // A private repository the caller has no role on is not listed, the
+                // same way its page 404s.
+                if ((0, perms_1.repoRole)(root, auth, { collection: c.name, name: (0, scan_1.displayName)(dirName), dir }) === null)
+                    continue;
+                repos.push(summarize(root, c.name, dirName));
+            }
+        }
+        res.json({ repos });
+    });
+    app.get('/api/repos/:collection/:repo', async (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const { repo, auth } = found;
+        const role = (0, perms_1.repoRole)(root, auth, repo);
+        const branches = await repo.listRefs('heads');
+        const tags = await repo.listRefs('tags');
+        const issues = (0, issues_1.issueCounts)(root, repo.collection, repo.name);
+        const pulls = (0, pulls_1.pullCounts)(root, repo.collection, repo.name);
+        res.json({
+            ...summarize(root, repo.collection, path.basename(repo.dir)),
+            defaultBranch: await repo.defaultBranch(branches),
+            updated: await repo.lastUpdated(),
+            branches: branches.length,
+            tags: tags.length,
+            releases: (0, releases_1.listReleases)(root, repo.collection, repo.name).length,
+            openIssues: issues.open,
+            closedIssues: issues.closed,
+            openPulls: pulls.open,
+            closedPulls: pulls.closed,
+            // What this token may do here, so that a caller need not discover it by
+            // being refused.
+            role,
+            canPush: (0, perms_1.atLeast)(role, 'write'),
+        });
+    });
+    app.get('/api/repos/:collection/:repo/branches', async (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const branches = await found.repo.listRefs('heads');
+        res.json({ branches, defaultBranch: await found.repo.defaultBranch(branches) });
+    });
+    app.get('/api/repos/:collection/:repo/tags', async (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        res.json({ tags: await found.repo.listRefs('tags') });
+    });
+    // Read only, and deliberately. Publishing a site is a workflow's job or a file
+    // copy into the vault; an upload path here would be a second way to write the
+    // one directory whose contents are served to browsers.
+    app.get('/api/repos/:collection/:repo/site', (req, res) => {
+        const found = (0, auth_1.requireRepo)(root, limiter, req, res);
+        if (!found)
+            return;
+        const dir = (0, scan_1.siteDir)(root, found.repo.collection, found.repo.name);
+        if (!dir) {
+            res.json({ exists: false });
+            return;
+        }
+        let entries = 0;
+        let updated = null;
+        try {
+            const walk = (d) => {
+                for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                    if (e.isDirectory())
+                        walk(path.join(d, e.name));
+                    else
+                        entries++;
+                }
+            };
+            walk(dir);
+            updated = fs.statSync(dir).mtime.toISOString();
+        }
+        catch {
+            // An unreadable site directory reports what it can rather than failing.
+        }
+        res.json({ exists: true, entries, updated });
+    });
+    // A repository name that is not two path segments is a caller's mistake rather
+    // than a missing repository, and saying so is cheaper than letting it 404.
+    app.all('/api/repos/:collection', (_req, res) => {
+        (0, auth_1.apiError)(res, 404, 'address a repository as /api/repos/<collection>/<repo>');
+    });
+}