@magland/mochi 0.3.1

package/dist/api.js

@@ -0,0 +1,326 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerApi = registerApi;
+const fs = __importStar(require("fs"));
+const express_1 = __importDefault(require("express"));
+const ops = __importStar(require("./ops"));
+const ops_1 = require("./ops");
+const layout_1 = require("./layout");
+const perms_1 = require("./perms");
+const scan_1 = require("./scan");
+const vault_1 = require("./vault");
+const auth_1 = require("./api/auth");
+const contents_1 = require("./api/contents");
+const issues_1 = require("./api/issues");
+const pulls_1 = require("./api/pulls");
+const repos_1 = require("./api/repos");
+const admin_1 = require("./api/admin");
+const backup_1 = require("./api/backup");
+const ci_1 = require("./api/ci");
+const releases_1 = require("./api/releases");
+const write_1 = require("./api/write");
+// The bearer-token JSON API used by the mochi CLI. Only Bearer tokens are
+// accepted; session cookies never authorize API calls.
+function registerApi(app, root, authLimiter, gates, lfs = null, engine, egress) {
+    // A write route carries a file in its body, so the limit is the one the upload
+    // route already applies rather than express's 100 kB default. Anything larger
+    // belongs in a push, or in Git LFS.
+    app.use('/api', express_1.default.json({ limit: ops_1.MAX_UPLOAD_SIZE }));
+    // The routes are split by subject, mirroring the split the HTML modules
+    // already have, so that no one file grows unmanageable. Each of them calls the
+    // same domain functions the web handlers call and the same authorization
+    // helpers, so the duplication between the two transports is transport only.
+    (0, repos_1.registerRepoApi)(app, root, authLimiter);
+    (0, contents_1.registerContentsApi)(app, root, authLimiter, gates);
+    (0, issues_1.registerIssueApi)(app, root, authLimiter);
+    (0, pulls_1.registerPullApi)(app, root, authLimiter, engine);
+    (0, write_1.registerWriteApi)(app, root, authLimiter, lfs, engine);
+    // The engine is constructed in createApp and already handed to registerCiApi,
+    // so these routes take it the same way. A vault serving with no engine has no
+    // workflows to answer about.
+    if (engine)
+        (0, ci_1.registerCiRunApi)(app, root, authLimiter, engine);
+    (0, releases_1.registerReleaseApi)(app, root, authLimiter);
+    (0, admin_1.registerAdminApi)(app, root, authLimiter, lfs, engine, egress);
+    // Reading a whole vault out over HTTP, for `mochi backup`. Admin over the
+    // whole vault, and behind the same gate a file listing holds.
+    (0, backup_1.registerBackupApi)(app, root, authLimiter, gates);
+    // Both helpers live in src/api/auth.ts now that more than one file of routes
+    // uses them; this closure only saves passing root at every call site.
+    const requireApiAuth = (req, res) => (0, auth_1.requireApiAuth)(root, authLimiter, req, res);
+    function sanitizeGlobs(v) {
+        if (v === undefined || v === null)
+            return undefined;
+        if (Array.isArray(v) && v.every((x) => typeof x === 'string' && x.length > 0 && x.length < 200)) {
+            return v;
+        }
+        return null;
+    }
+    // What a caller may reach, filtered to their eyes: a private repository the
+    // caller has no role on is left out, here and in every listing.
+    const visibleRepos = (auth, collection) => (0, scan_1.listRepoDirs)(root, collection).filter((dirName) => (0, perms_1.repoRole)(root, auth, {
+        collection,
+        name: (0, scan_1.displayName)(dirName),
+        dir: (0, layout_1.repoPath)(root, collection, dirName),
+    }) !== null);
+    app.get('/api/whoami', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        res.json({
+            username: auth.username,
+            siteAdmin: auth.user.siteAdmin === true,
+            ownedCollections: (0, scan_1.listCollections)(root)
+                .map((c) => c.name)
+                .filter((c) => c === auth.username || (0, perms_1.collectionOwners)(root, c).includes(auth.username)),
+            tokenScope: auth.token.scope ?? null,
+        });
+    });
+    // Collections, for the CLI. `mochi import` asks what is already in a
+    // collection before it pushes, and `mochi collection add` makes an empty
+    // one, which is the case a push cannot cover: pushing creates the collection
+    // it lands in, so a collection with nothing in it yet has to be asked for.
+    app.get('/api/collections', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        res.json({
+            collections: (0, scan_1.listCollections)(root).map((c) => ({ name: c.name, repoCount: visibleRepos(auth, c.name).length })),
+        });
+    });
+    app.get('/api/collections/:name', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        const name = req.params.name;
+        let isDir = false;
+        try {
+            isDir = fs.statSync((0, layout_1.collectionDir)(root, name)).isDirectory();
+        }
+        catch {
+            isDir = false;
+        }
+        if (!(0, scan_1.isValidName)(name) || !isDir) {
+            (0, auth_1.apiError)(res, 404, `no collection ${name} in this vault`);
+            return;
+        }
+        res.json({ name, owners: (0, perms_1.collectionOwners)(root, name), repos: visibleRepos(auth, name).map(scan_1.displayName) });
+    });
+    app.post('/api/collections', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        const body = (req.body ?? {});
+        const name = typeof body.name === 'string' ? body.name.trim() : '';
+        if (!(0, scan_1.isValidName)(name)) {
+            (0, auth_1.apiError)(res, 400, 'a valid "name" is required (letters, digits, dot, underscore, dash; not a reserved word)');
+            return;
+        }
+        if (!(0, perms_1.canCreateCollection)(root, auth, name)) {
+            (0, auth_1.apiError)(res, 403, `only a site admin can create a collection not named after you`);
+            return;
+        }
+        try {
+            ops.createCollection(root, name);
+        }
+        catch (e) {
+            if (e instanceof ops_1.OpError) {
+                (0, auth_1.apiError)(res, (0, ops_1.opErrorStatus)(e.kind), e.message);
+                return;
+            }
+            throw e;
+        }
+        res.json({ name, created: true });
+    });
+    // ---- collection owners ----
+    // Owners manage the owners list, and site admins do; the same rule the
+    // collection's settings page applies.
+    app.put('/api/collections/:name/owners/:user', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        const name = req.params.name;
+        const username = req.params.user;
+        if (!(0, scan_1.isValidName)(name) || !fs.existsSync((0, layout_1.collectionDir)(root, name))) {
+            (0, auth_1.apiError)(res, 404, `no collection ${name} in this vault`);
+            return;
+        }
+        if (!(0, perms_1.canAdminCollection)(root, auth, name)) {
+            (0, auth_1.apiError)(res, 403, `you are not an owner of ${name}`);
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok' || !state.vault.users[username]) {
+            (0, auth_1.apiError)(res, 404, `no user ${username} in this vault`);
+            return;
+        }
+        if (username === name) {
+            res.json({ name, owners: (0, perms_1.collectionOwners)(root, name), note: `${username} owns ${name} by name already` });
+            return;
+        }
+        (0, perms_1.addCollectionOwner)(root, name, username);
+        res.json({ name, owners: (0, perms_1.collectionOwners)(root, name) });
+    });
+    app.delete('/api/collections/:name/owners/:user', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        const name = req.params.name;
+        const username = req.params.user;
+        if (!(0, scan_1.isValidName)(name) || !fs.existsSync((0, layout_1.collectionDir)(root, name))) {
+            (0, auth_1.apiError)(res, 404, `no collection ${name} in this vault`);
+            return;
+        }
+        if (!(0, perms_1.canAdminCollection)(root, auth, name)) {
+            (0, auth_1.apiError)(res, 403, `you are not an owner of ${name}`);
+            return;
+        }
+        if (!(0, perms_1.collectionOwners)(root, name).includes(username)) {
+            (0, auth_1.apiError)(res, 404, `${username} is not an explicit owner of ${name}`);
+            return;
+        }
+        (0, perms_1.removeCollectionOwner)(root, name, username);
+        res.json({ name, owners: (0, perms_1.collectionOwners)(root, name) });
+    });
+    // Users are the site admin's business, as they are on GitHub: creating one,
+    // listing them, and the site-admin bit itself. What a user may reach is not
+    // set here at all; it lives with the collections and repositories that
+    // grant it.
+    app.get('/api/users', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        if (!(0, perms_1.isSiteAdmin)(auth)) {
+            (0, auth_1.apiError)(res, 403, 'site admin required (with an unrestricted token)');
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            (0, auth_1.apiError)(res, 500, 'vault unavailable');
+            return;
+        }
+        res.json({
+            users: Object.entries(state.vault.users).map(([name, u]) => ({
+                name,
+                siteAdmin: u.siteAdmin === true,
+                tokens: u.tokens.length,
+            })),
+        });
+    });
+    app.post('/api/users', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        const body = (req.body ?? {});
+        const username = typeof body.username === 'string' ? body.username : '';
+        if (!(0, scan_1.isValidUserName)(username)) {
+            (0, auth_1.apiError)(res, 400, 'a valid "username" is required');
+            return;
+        }
+        const tokenScope = sanitizeGlobs(body.tokenScope);
+        if (tokenScope === null) {
+            (0, auth_1.apiError)(res, 400, '"tokenScope" must be a list of strings');
+            return;
+        }
+        // Refused loudly rather than ignored: an older client sending the glob
+        // fields would otherwise create a user without the access its operator
+        // asked for, and silence is the worst way to deliver that.
+        if (body.scope !== undefined || body.admin !== undefined) {
+            (0, auth_1.apiError)(res, 400, '"scope" and "admin" are gone: a user owns the collection named after them, and anything more is ' +
+                'granted where it applies (repository collaborators, collection owners) or with "siteAdmin"');
+            return;
+        }
+        if (body.siteAdmin !== undefined && typeof body.siteAdmin !== 'boolean') {
+            (0, auth_1.apiError)(res, 400, '"siteAdmin" must be a boolean');
+            return;
+        }
+        if (!(0, perms_1.isSiteAdmin)(auth)) {
+            (0, auth_1.apiError)(res, 403, 'site admin required (with an unrestricted token)');
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            (0, auth_1.apiError)(res, 500, 'vault unavailable');
+            return;
+        }
+        const existing = state.vault.users[username];
+        if (existing && body.siteAdmin !== undefined) {
+            (0, auth_1.apiError)(res, 409, `user ${username} already exists; use 'mochi user grant' to change the site-admin bit`);
+            return;
+        }
+        const result = (0, vault_1.addUserToken)(root, username, {
+            siteAdmin: body.siteAdmin === true,
+            tokenScope: tokenScope ?? undefined,
+        });
+        res.json({
+            username,
+            created: result.created,
+            token: result.token,
+            siteAdmin: result.user.siteAdmin === true,
+        });
+    });
+    app.post('/api/users/:name/grant', (req, res) => {
+        const auth = requireApiAuth(req, res);
+        if (!auth)
+            return;
+        const username = req.params.name;
+        if (!(0, scan_1.isValidName)(username)) {
+            (0, auth_1.apiError)(res, 400, 'invalid username');
+            return;
+        }
+        const body = (req.body ?? {});
+        if (typeof body.siteAdmin !== 'boolean') {
+            (0, auth_1.apiError)(res, 400, 'provide "siteAdmin": true or false; per-repository access is granted on the repository (collaborators) or the collection (owners)');
+            return;
+        }
+        if (!(0, perms_1.isSiteAdmin)(auth)) {
+            (0, auth_1.apiError)(res, 403, 'site admin required (with an unrestricted token)');
+            return;
+        }
+        let user;
+        try {
+            user = (0, vault_1.setSiteAdmin)(root, username, body.siteAdmin);
+        }
+        catch (e) {
+            (0, auth_1.apiError)(res, 404, e instanceof Error ? e.message : String(e));
+            return;
+        }
+        res.json({ username, siteAdmin: user.siteAdmin === true });
+    });
+}

package/dist/assets.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.styleSheet = styleSheet;
+const crypto_1 = require("crypto");
+const style_1 = require("./style");
+const themes_1 = require("./themes");
+/**
+ * The forge's stylesheet, with a tag naming this exact body.
+ *
+ * The sheet is 76 KB and every page links it, so what it costs is decided by
+ * whether the browser may keep it. It used to say `no-cache`, which bought a
+ * conditional request on every navigation -- 304 at best, and a round trip
+ * before anything could be painted. The tag ends that: it is a hash of the
+ * bytes, so a changed theme or an edited style.ts changes the URL, and any URL
+ * that carries the right tag can be kept for good.
+ *
+ * Built once per theme rather than per request, which also stops the 76 KB
+ * concatenation from happening on every hit.
+ */
+const sheets = new Map();
+function styleSheet(theme) {
+    const made = sheets.get(theme.name);
+    if (made)
+        return made;
+    const body = (0, themes_1.allThemeVarsCss)(theme) + style_1.CSS;
+    const sheet = { body, tag: (0, crypto_1.createHash)('sha256').update(body).digest('hex').slice(0, 12) };
+    sheets.set(theme.name, sheet);
+    return sheet;
+}

package/dist/atom.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.atomFeed = atomFeed;
+const render_1 = require("./render");
+function iso(date) {
+    const d = new Date(date);
+    return isNaN(d.getTime()) ? new Date(0).toISOString() : d.toISOString();
+}
+function atomFeed(feed) {
+    // The feed's own timestamp is that of its newest entry, and the epoch when
+    // it has none, so a reader can tell a quiet feed from a broken one.
+    const updated = feed.entries.length ? iso(feed.entries[0].updated) : new Date(0).toISOString();
+    const entries = feed.entries
+        .map((e) => `  <entry>
+    <id>${(0, render_1.esc)(e.id)}</id>
+    <title>${(0, render_1.esc)(e.title)}</title>
+    <updated>${(0, render_1.esc)(iso(e.updated))}</updated>
+    <link rel="alternate" type="text/html" href="${(0, render_1.esc)(e.link)}"/>
+    <author><name>${(0, render_1.esc)(e.author)}</name></author>${e.summary ? `\n    <content type="text">${(0, render_1.esc)(e.summary)}</content>` : ''}
+  </entry>`)
+        .join('\n');
+    return `<?xml version="1.0" encoding="utf-8"?>
+<feed xmlns="http://www.w3.org/2005/Atom">
+  <id>${(0, render_1.esc)(feed.id)}</id>
+  <title>${(0, render_1.esc)(feed.title)}</title>
+  <updated>${(0, render_1.esc)(updated)}</updated>
+  <link rel="self" type="application/atom+xml" href="${(0, render_1.esc)(feed.selfLink)}"/>
+  <link rel="alternate" type="text/html" href="${(0, render_1.esc)(feed.htmlLink)}"/>
+${entries}
+</feed>
+`;
+}

package/dist/atomic.js

@@ -0,0 +1,171 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeFileAtomic = writeFileAtomic;
+exports.withFileLock = withFileLock;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Replace a file's contents in one step, durably.
+ *
+ * A vault is a directory of plain files and nothing else, so the files that
+ * hold its state are the state. Six places wrote one of them by the same
+ * three lines, writing a sibling `.tmp` and renaming it over the target, which
+ * is what stops a reader from seeing half a file: a rename within a directory
+ * is atomic, so a concurrent read sees the old contents or the new ones.
+ *
+ * What those six lines did not do is reach the disk. A rename can be recorded
+ * before the data the renamed file points at, so a machine that loses power at
+ * the wrong moment can come back to a `vault.json` that exists, parses as
+ * nothing, and locks every user out of a vault whose repositories are all
+ * still there. That is the one failure here worth paying two fsyncs to avoid:
+ * one on the contents before the rename, and one on the directory afterwards,
+ * which is what makes the rename itself survive.
+ *
+ * The temporary name carries the process id, so two servers pointed at one
+ * vault cannot write over each other's half-written file. It does not by itself
+ * make the larger read-modify-write safe; `withFileLock` below is what does
+ * that, and a caller that reads a state file, changes it, and writes it back
+ * belongs inside one.
+ */
+function writeFileAtomic(file, data, opts = {}) {
+    const tmp = `${file}.tmp-${process.pid}`;
+    const fd = fs.openSync(tmp, 'w', opts.mode ?? 0o666);
+    try {
+        fs.writeFileSync(fd, data);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        fs.renameSync(tmp, file);
+    }
+    catch (e) {
+        fs.rmSync(tmp, { force: true });
+        throw e;
+    }
+    // The rename is what has to survive, and it lives in the directory rather
+    // than in either file. Not every platform lets a directory be opened, and a
+    // vault on one that does not is better served slightly less durably than not
+    // at all, so this is attempted rather than required.
+    let dir = null;
+    try {
+        dir = fs.openSync(path.dirname(file), 'r');
+        fs.fsyncSync(dir);
+    }
+    catch {
+        // no directory handle to sync on this platform
+    }
+    finally {
+        if (dir !== null)
+            fs.closeSync(dir);
+    }
+}
+// How long a lock may be held before another holder assumes its owner died.
+// The critical sections here are a small read, an edit in memory, and a write,
+// so anything approaching this is a crashed process rather than a slow one.
+const LOCK_STALE_MS = 10 * 1000;
+// How long to wait for a lock before giving up. Well beyond any honest holder,
+// and beyond the staleness threshold, so a wait that ends in a throw means
+// something is wrong rather than merely busy.
+const LOCK_TIMEOUT_MS = 15 * 1000;
+const LOCK_RETRY_MS = 20;
+/** Sleep without yielding, which is what a synchronous critical section needs. */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Run `fn` while holding an exclusive lock on `lockPath`, so that a read, an
+ * edit, and a write back are one operation against other processes as well as
+ * against other requests.
+ *
+ * The state files at a vault's root are read-modify-written by whoever has the
+ * directory: the server answering `POST /api/users`, and `mochi user add`
+ * run against the same path from a shell. Both were reading, editing in memory,
+ * and writing the whole file back, so two of them overlapping lost one edit
+ * entirely - a user created and then gone, or a token revoked and then back.
+ * Node's single thread makes each of these safe within one process, since none
+ * of them awaits; it says nothing about two.
+ *
+ * `open(O_CREAT|O_EXCL)` is the lock: it is one atomic step on every platform
+ * this runs on, and it needs no dependency. A lock older than LOCK_STALE_MS is
+ * taken to belong to a process that died holding it and is broken, because the
+ * alternative is a vault that cannot be administered until someone finds a
+ * stray file. The lock is advisory in the sense that matters: hand-editing
+ * `vault.json` while the server runs still works, exactly as the documentation
+ * promises, and is still the operator's own business to time.
+ */
+function withFileLock(lockPath, fn) {
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let fd = null;
+    for (;;) {
+        try {
+            fd = fs.openSync(lockPath, 'wx');
+            break;
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
+            let age = 0;
+            try {
+                age = Date.now() - fs.statSync(lockPath).mtimeMs;
+            }
+            catch {
+                // It went away between the open and the stat; just retry.
+                continue;
+            }
+            if (age > LOCK_STALE_MS) {
+                fs.rmSync(lockPath, { force: true });
+                continue;
+            }
+            if (Date.now() > deadline) {
+                throw new Error(`timed out waiting for the lock at ${lockPath}; remove it if no mochi process is running`);
+            }
+            sleepSync(LOCK_RETRY_MS);
+        }
+    }
+    try {
+        fs.writeSync(fd, String(process.pid));
+        fs.closeSync(fd);
+        fd = null;
+        return fn();
+    }
+    finally {
+        if (fd !== null)
+            fs.closeSync(fd);
+        fs.rmSync(lockPath, { force: true });
+    }
+}

package/dist/avatar.js

@@ -0,0 +1,81 @@
+"use strict";
+// Identicons.
+//
+// GitHub puts a face beside every name, and a name without one reads as
+// unfinished next to it. A vault has no uploaded pictures and no gravatar
+// lookups (that would be a request to a third party on every page), so the
+// picture is drawn from the name itself: the same name always draws the same
+// mark, and two different names almost never draw the same one.
+//
+// The drawing is GitHub's own identicon construction. A 5 x 5 grid of cells
+// is filled from the bits of a hash of the name, mirrored about the middle
+// column so the result reads as a face rather than as noise, and painted in a
+// single hue taken from the same hash. Lightness and saturation are fixed at
+// values that hold their contrast against both a near-white and a near-black
+// page, so one drawing serves every theme.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identicon = identicon;
+exports.avatar = avatar;
+const crypto = __importStar(require("crypto"));
+const html_1 = require("./html");
+/** The identicon for a name, as an inline SVG of the given pixel size. */
+function identicon(name, size = 20) {
+    const hash = crypto.createHash('sha256').update(name.trim().toLowerCase()).digest();
+    const hue = Math.round((hash[0] / 256) * 360);
+    const fill = `hsl(${hue} 58% 46%)`;
+    // Cells are addressed by the left three columns; bit i of the hash body
+    // decides cell i, and columns 3 and 4 mirror columns 1 and 0.
+    const cells = [];
+    for (let col = 0; col < 3; col++) {
+        for (let row = 0; row < 5; row++) {
+            if ((hash[1 + col * 5 + row] & 1) === 0)
+                continue;
+            for (const c of col === 2 ? [2] : [col, 4 - col]) {
+                cells.push(`<rect x="${c}" y="${row}" width="1" height="1"/>`);
+            }
+        }
+    }
+    return (0, html_1.raw)(`<svg class="identicon" width="${size}" height="${size}" viewBox="0 0 5 5" role="img" aria-label="${escapeAttr(name)}" fill="${fill}">${cells.join('')}</svg>`);
+}
+/** The identicon in the frame the interface puts round it. */
+function avatar(name, size = 20, cls = '') {
+    return (0, html_1.raw)(`<span class="avatar${cls ? ` ${cls}` : ''}" style="width:${size}px;height:${size}px">${identicon(name, size)}</span>`);
+}
+// Local rather than imported from render.ts: this file is about drawing, and
+// the only thing it interpolates is the name in a label.
+function escapeAttr(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}