@nickmeriano/task 0.10.0 → 0.12.0

package/dist/board/handler.js

@@ -0,0 +1,183 @@
+/**
+ * The live proxy: an exported board's API, as one fetch handler.
+ *
+ * `task export` ships the board as static files plus a baked `snapshot.json`.
+ * Drop this next to them — as a Cloudflare Pages Function, or behind any host
+ * that can run a `(Request) => Response` — hand it a token, and the same
+ * files become a live board: the SPA probes for an API before it mounts,
+ * finds this one answering, and never reads the snapshot at all. No token,
+ * no function, and the probe fails and the snapshot is what you get. The
+ * upgrade is the deploy, not a rebuild.
+ *
+ * The routes are `task serve`'s read routes — the same ones the snapshot
+ * answers (`ui/src/snapshot.ts`), plus the two things a live proxy is *for*:
+ * `?ref=` to read any branch, and `/branches` so the switcher has something to
+ * list. Payloads come from `source.ts`, which is what the hosted board serves,
+ * so a board rendered from this differs from the hosted one in one thing:
+ * who may look. This tier has no viewer auth — the perimeter is wherever you
+ * deploy it — and it says so in `/project` the only way the SPA reads:
+ * `readOnly: true`, no `git` capability.
+ *
+ * Read-only by construction: anything but GET is a 405 before a token is
+ * even resolved.
+ */
+import { GitHubError, headCommit, isMissingRef, listBranches, repoInfo } from "./github.js";
+import { BoardSourceError, SnapshotMemory, STATUSES, snapshotAt, } from "./source.js";
+const REF_PATTERN = /^[\w.\-/]{1,255}$/;
+/** `owner/name`, both halves as GitHub spells them. */
+export const REPO_PATTERN = /^[\w.-]+\/[\w.-]+$/;
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "Content-Type": "application/json; charset=utf-8",
+            // Every answer is "the repository right now"; nothing between this
+            // function and the browser should hold on to one.
+            "Cache-Control": "no-store",
+        },
+    });
+}
+/** The board the request asked for, or the repo's default — `pickBoard`'s rule. */
+function pickBoard(snapshot, requested) {
+    const id = requested && snapshot.data.has(requested) ? requested : snapshot.boards[0]?.id;
+    return id === undefined ? null : (snapshot.data.get(id) ?? null);
+}
+export function createBoardHandler(options) {
+    const { repo: slug, ref: defaultRef = "HEAD" } = options;
+    if (!REPO_PATTERN.test(slug))
+        throw new Error(`repo must be owner/name — got ${JSON.stringify(slug)}`);
+    const [owner, repo] = slug.split("/");
+    const basePath = (options.basePath ?? "/api").replace(/\/+$/, "");
+    const memory = new SnapshotMemory(options.maxCachedSnapshots);
+    // A cold start sees the SPA's four boot requests at once, all for the same
+    // commit. One tarball, not four: the first caller's load is shared with
+    // everyone who asks for that sha while it is still in flight.
+    const inFlight = new Map();
+    async function resolveToken() {
+        const token = typeof options.token === "function" ? await options.token() : options.token;
+        if (!token) {
+            // Unconfigured is not an error the board can act on; it is "no API",
+            // and a 5xx is exactly what makes the SPA's probe fall back to the
+            // snapshot sitting next to this function.
+            throw new BoardSourceError(503, "no GitHub token configured for the live board", "no-token");
+        }
+        return token;
+    }
+    async function load(token, ref, explicit) {
+        let commit;
+        try {
+            commit = await headCommit(token, owner, repo, ref);
+        }
+        catch (error) {
+            // With an explicit ref, a miss almost always means the branch — a
+            // deleted preview, a typo — not the repository.
+            if (explicit && isMissingRef(error)) {
+                throw new BoardSourceError(404, `no such branch or ref: ${ref}`, "no-such-ref");
+            }
+            throw error;
+        }
+        const key = `${owner}/${repo}@${commit.sha}`;
+        const cached = memory.get(key);
+        if (cached)
+            return cached;
+        let pending = inFlight.get(key);
+        if (!pending) {
+            pending = snapshotAt(token, owner, repo, commit, ref)
+                .then((snapshot) => memory.remember(key, snapshot))
+                .finally(() => inFlight.delete(key));
+            inFlight.set(key, pending);
+        }
+        return pending;
+    }
+    async function handle(request) {
+        if (request.method !== "GET" && request.method !== "HEAD") {
+            // Every editing affordance is already hidden by `readOnly`; this is the
+            // backstop, in the shape `ApiError` reads.
+            return json({ error: "this board is read-only — commit and push to change it", reason: "read-only" }, 405);
+        }
+        const url = new URL(request.url);
+        if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) {
+            return json({ error: `not an API path: ${url.pathname}` }, 404);
+        }
+        const route = url.pathname.slice(basePath.length) || "/";
+        const token = await resolveToken();
+        if (route === "/branches") {
+            // Default branch first (it's the way back), then alphabetical — the
+            // hosted board's order, which is the order the switcher expects.
+            const [names, info] = await Promise.all([
+                listBranches(token, owner, repo),
+                repoInfo(token, owner, repo),
+            ]);
+            const branches = names
+                .map((name) => ({ name, isDefault: name === info.defaultBranch }))
+                .sort((a, b) => Number(b.isDefault) - Number(a.isDefault) || a.name.localeCompare(b.name));
+            return json({ branches });
+        }
+        // A ref is a viewer-supplied string that lands in a URL path; anything
+        // outside git's own naming rules is ignored rather than escaped.
+        const requestedRef = url.searchParams.get("ref");
+        const ref = requestedRef && REF_PATTERN.test(requestedRef) && !requestedRef.includes("..")
+            ? requestedRef
+            : null;
+        const snapshot = await load(token, ref ?? defaultRef, ref !== null);
+        if (route === "/boards")
+            return json({ boards: snapshot.boards });
+        const board = pickBoard(snapshot, url.searchParams.get("board"));
+        if (!board)
+            return json({ error: "no such board" }, 404);
+        if (route === "/project") {
+            return json({
+                name: board.info.name,
+                prefix: board.info.prefix,
+                statuses: STATUSES,
+                // The payload the SPA reads to decide whether to offer editing at all.
+                // The data is a commit; the only way to change one is to push.
+                readOnly: true,
+                // Locally this is who would author a comment. Nothing here can
+                // comment, and nothing here knows who is looking.
+                author: "",
+            });
+        }
+        if (route === "/tasks")
+            return json({ tasks: board.tasks });
+        if (route === "/goals")
+            return json({ goals: board.goals });
+        const detail = /^\/tasks\/([^/]+)$/.exec(route);
+        if (detail) {
+            // The CLI accepts "PREFIX-x7k4m" or "x7k4m"; so does this.
+            const match = /^(?:[A-Za-z0-9]+-)?([A-Za-z0-9]+)$/.exec(decodeURIComponent(detail[1]));
+            if (!match)
+                return json({ error: "invalid task id" }, 400);
+            const key = match[1].toLowerCase();
+            const task = board.tasks.find((candidate) => candidate.key === key);
+            if (!task)
+                return json({ error: `no such task: ${key}` }, 404);
+            return json({ task, comments: board.comments.get(key) ?? [] });
+        }
+        // `/inbox` and the git surface are deliberately absent: the SPA degrades
+        // to no inbox and no git chrome when they 404, same as the hosted board.
+        return json({ error: `not here: ${route}` }, 404);
+    }
+    return async (request) => {
+        try {
+            return await handle(request);
+        }
+        catch (error) {
+            if (error instanceof BoardSourceError) {
+                return json({ error: error.message, reason: error.reason }, error.status);
+            }
+            if (error instanceof GitHubError) {
+                // A bad or expired token, a repo the token can't see, GitHub itself
+                // down: all of them are "the live board can't answer right now". A
+                // 5xx is deliberate — on the boot probe it is what sends the SPA to
+                // the snapshot instead of an error screen.
+                return json({
+                    error: `GitHub answered ${error.status} — check the token and the repository name`,
+                    reason: "github",
+                }, 502);
+            }
+            return json({ error: error instanceof Error ? error.message : "internal error" }, 500);
+        }
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/board/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/board/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3F,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,UAAU,GAGX,MAAM,aAAa,CAAA;AA2BpB,MAAM,WAAW,GAAG,mBAAmB,CAAA;AAEvC,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,mEAAmE;YACnE,kDAAkD;YAClD,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAA;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,QAAkB,EAAE,SAAwB;IAC7D,MAAM,EAAE,GAAG,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IACzF,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,EAAE,GAAG,OAAO,CAAA;IACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC7D,2EAA2E;IAC3E,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAA;IAErD,KAAK,UAAU,YAAY;QACzB,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QACzF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,+CAA+C,EAAE,UAAU,CAAC,CAAA;QAC9F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,GAAW,EAAE,QAAiB;QAC/D,IAAI,MAAM,CAAA;QACV,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,gDAAgD;YAChD,IAAI,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,0BAA0B,GAAG,EAAE,EAAE,aAAa,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;iBAClD,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;iBAClD,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YACtC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5B,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,wEAAwE;YACxE,2CAA2C;YAC3C,OAAO,IAAI,CACT,EAAE,KAAK,EAAE,wDAAwD,EAAE,MAAM,EAAE,WAAW,EAAE,EACxF,GAAG,CACJ,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACxD,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;QAElC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACtC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;gBAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;aAC7B,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,KAAK;iBACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;iBACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YAC5F,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3B,CAAC;QAED,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAChD,MAAM,GAAG,GACP,YAAY,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC5E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,CAAA;QACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,UAAU,EAAE,GAAG,KAAK,IAAI,CAAC,CAAA;QAEnE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAEjE,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAExD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,uEAAuE;gBACvE,+DAA+D;gBAC/D,QAAQ,EAAE,IAAI;gBACd,+DAA+D;gBAC/D,kDAAkD;gBAClD,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3D,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAE3D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,2DAA2D;YAC3D,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACtF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;YAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACnE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YAC9D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAChE,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,2CAA2C;gBAC3C,OAAO,IAAI,CACT;oBACE,KAAK,EAAE,mBAAmB,KAAK,CAAC,MAAM,4CAA4C;oBAClF,MAAM,EAAE,QAAQ;iBACjB,EACD,GAAG,CACJ,CAAA;YACH,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/board/handler.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The live proxy, against a fake GitHub.
+ *
+ * `globalThis.fetch` is replaced with a tiny router that answers the four
+ * calls the handler makes — head commit, tarball, branches, repo info — from
+ * an in-memory repository, so what's under test is the handler's routing,
+ * caching and error shapes, not the network. The payloads themselves are
+ * pinned elsewhere (`source.test.ts` diffs them against the CLI's store).
+ */
+export {};
+//# sourceMappingURL=handler.test.d.ts.map

package/dist/board/handler.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.test.d.ts","sourceRoot":"","sources":["../../src/board/handler.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/board/handler.test.js

@@ -0,0 +1,229 @@
+/**
+ * The live proxy, against a fake GitHub.
+ *
+ * `globalThis.fetch` is replaced with a tiny router that answers the four
+ * calls the handler makes — head commit, tarball, branches, repo info — from
+ * an in-memory repository, so what's under test is the handler's routing,
+ * caching and error shapes, not the network. The payloads themselves are
+ * pinned elsewhere (`source.test.ts` diffs them against the CLI's store).
+ */
+import assert from "node:assert/strict";
+import { afterEach, beforeEach, mock, test } from "node:test";
+import { gzipSync } from "node:zlib";
+import { createBoardHandler } from "./handler.js";
+const encoder = new TextEncoder();
+/** Just enough tar to be a GitHub tarball: ustar headers, one root dir. */
+function tarball(root, files) {
+    const blocks = [];
+    for (const [path, text] of Object.entries(files)) {
+        const data = encoder.encode(text);
+        const header = new Uint8Array(512);
+        header.set(encoder.encode(`${root}/${path}`).subarray(0, 100), 0);
+        header.set(encoder.encode("0000644\0"), 100);
+        header.set(encoder.encode(data.length.toString(8).padStart(11, "0") + "\0"), 124);
+        header.set(encoder.encode("00000000000\0"), 136);
+        header[156] = 0x30;
+        header.set(encoder.encode("ustar\x0000"), 257);
+        header.set(encoder.encode("        "), 148);
+        const sum = header.reduce((a, b) => a + b, 0);
+        header.set(encoder.encode(sum.toString(8).padStart(6, "0") + "\0 "), 148);
+        const padded = new Uint8Array(Math.ceil(data.length / 512) * 512);
+        padded.set(data);
+        blocks.push(header, padded);
+    }
+    blocks.push(new Uint8Array(1024));
+    const out = new Uint8Array(blocks.reduce((n, b) => n + b.length, 0));
+    let at = 0;
+    for (const block of blocks) {
+        out.set(block, at);
+        at += block.length;
+    }
+    return out;
+}
+const CONFIG = JSON.stringify({ name: "acme", prefix: "ACM", version: 2 });
+const ticket = (title, status, position = 0) => `---\nstatus: ${status}\nposition: ${position}\ncreated: 2026-01-01T00:00:00.000Z\nupdated: 2026-01-01T00:00:00.000Z\n---\n\n# ${title}\n`;
+/** Two commits: `main` at `aaa`, `feature` at `bbb`, each its own board state. */
+const COMMITS = { HEAD: "aaa", main: "aaa", feature: "bbb" };
+const TREES = {
+    aaa: {
+        ".task/config.json": CONFIG,
+        ".task/tickets/x7k4m/ticket.md": ticket("Ship it", "todo"),
+        ".task/tickets/x7k4m/comments/2026-01-02T000000-nick.md": '---\nauthor: "nick"\ncreated: 2026-01-02T00:00:00.000Z\n---\n\nsoon',
+        ".task/goals/launch.md": "---\ncreated: 2026-01-01T00:00:00.000Z\nupdated: 2026-01-01T00:00:00.000Z\n---\n\n# Launch\n",
+        "pkg/.task/config.json": JSON.stringify({ name: "pkg", prefix: "PKG", version: 2 }),
+        "pkg/.task/tickets/q3v8d/ticket.md": ticket("Nested", "backlog"),
+    },
+    bbb: {
+        ".task/config.json": CONFIG,
+        ".task/tickets/x7k4m/ticket.md": ticket("Ship it", "done"),
+        ".task/tickets/zz9zz/ticket.md": ticket("Only on the branch", "todo", 1),
+    },
+};
+let calls = [];
+let githubStatus = null;
+function fakeGitHub(input, init) {
+    const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+    const auth = new Headers(init?.headers).get("Authorization");
+    calls.push({ path: url.pathname, auth });
+    if (githubStatus !== null)
+        return Promise.resolve(new Response("nope", { status: githubStatus }));
+    const commit = /^\/repos\/acme\/widgets\/commits\/(.+)$/.exec(url.pathname);
+    if (commit) {
+        const sha = COMMITS[decodeURIComponent(commit[1])];
+        if (!sha)
+            return Promise.resolve(new Response("{}", { status: 422 }));
+        return Promise.resolve(Response.json({
+            sha,
+            commit: { message: `commit ${sha}\n\nbody`, committer: { date: "2026-01-03T00:00:00Z" } },
+        }));
+    }
+    const tar = /^\/repos\/acme\/widgets\/tarball\/(.+)$/.exec(url.pathname);
+    if (tar) {
+        const tree = TREES[tar[1]];
+        if (!tree)
+            return Promise.resolve(new Response(null, { status: 404 }));
+        return Promise.resolve(new Response(gzipSync(tarball(`acme-widgets-${tar[1]}`, tree))));
+    }
+    if (url.pathname === "/repos/acme/widgets/branches") {
+        return Promise.resolve(Response.json([{ name: "feature" }, { name: "main" }, { name: "docs" }]));
+    }
+    if (url.pathname === "/repos/acme/widgets") {
+        return Promise.resolve(Response.json({ default_branch: "main", private: true }));
+    }
+    return Promise.resolve(new Response(null, { status: 404 }));
+}
+beforeEach(() => {
+    calls = [];
+    githubStatus = null;
+    mock.method(globalThis, "fetch", fakeGitHub);
+});
+afterEach(() => mock.restoreAll());
+function handler(extra = {}) {
+    return createBoardHandler({ token: "ghp_test", repo: "acme/widgets", ...extra });
+}
+async function get(h, path, base = "/api") {
+    const res = await h(new Request(`https://board.example${base}${path}`));
+    return { status: res.status, body: (await res.json()) };
+}
+test("answers the read routes in the serve API's shapes", async () => {
+    const h = handler();
+    const project = await get(h, "/project");
+    assert.equal(project.status, 200);
+    assert.deepEqual(project.body, {
+        name: "acme",
+        prefix: "ACM",
+        statuses: ["backlog", "todo", "in_progress", "done", "canceled"],
+        readOnly: true,
+        author: "",
+    });
+    const boards = await get(h, "/boards");
+    assert.deepEqual(boards.body, {
+        boards: [
+            { id: ".", name: "acme", prefix: "ACM" },
+            { id: "pkg", name: "pkg", prefix: "PKG" },
+        ],
+    });
+    const tasks = await get(h, "/tasks");
+    const list = tasks.body.tasks;
+    assert.deepEqual(list.map((t) => [t.id, t.status, t.commentCount]), [["ACM-x7k4m", "todo", 1]]);
+    const goals = await get(h, "/goals");
+    assert.deepEqual(goals.body.goals.map((g) => g.slug), ["launch"]);
+    // Detail takes the display id or the bare key, like the CLI.
+    for (const id of ["ACM-x7k4m", "x7k4m"]) {
+        const detail = await get(h, `/tasks/${id}`);
+        assert.equal(detail.status, 200, id);
+        assert.equal(detail.body.task.title, "Ship it");
+        assert.deepEqual(detail.body.comments.map((c) => [c.author, c.body]), [["nick", "soon"]]);
+    }
+    assert.equal((await get(h, "/tasks/nope1")).status, 404);
+    assert.equal((await get(h, "/tasks/not%20an%20id")).status, 400);
+    // `?board=` picks the nested board; an unknown one falls back to the default.
+    const nested = await get(h, "/tasks?board=pkg");
+    assert.deepEqual(nested.body.tasks.map((t) => t.id), ["PKG-q3v8d"]);
+    assert.equal((await get(h, "/project?board=nope")).body.prefix, "ACM");
+    // Not in this API: the SPA degrades on a 404 exactly as it does hosted.
+    assert.equal((await get(h, "/inbox")).status, 404);
+    assert.equal((await get(h, "/git/status")).status, 404);
+});
+test("anything but a read is refused with the read-only reason", async () => {
+    const h = handler();
+    const res = await h(new Request("https://board.example/api/tasks", { method: "POST", body: "{}" }));
+    assert.equal(res.status, 405);
+    assert.equal((await res.json()).reason, "read-only");
+    // Refused before GitHub is asked anything.
+    assert.equal(calls.length, 0);
+});
+test("?ref= reads another branch; a missing ref is a 404 the SPA can name", async () => {
+    const h = handler();
+    const branch = await get(h, "/tasks?ref=feature");
+    assert.deepEqual(branch.body.tasks.map((t) => [t.id, t.status]), [
+        ["ACM-x7k4m", "done"],
+        ["ACM-zz9zz", "todo"],
+    ]);
+    const gone = await get(h, "/tasks?ref=gone");
+    assert.equal(gone.status, 404);
+    assert.equal(gone.body.reason, "no-such-ref");
+    // A ref that isn't a git name is ignored rather than sent to GitHub.
+    const bad = await get(h, "/tasks?ref=..%2F..%2Fetc");
+    assert.equal(bad.status, 200);
+    assert.ok(calls.every((c) => !c.path.includes("etc")));
+});
+test("/branches lists the repo's branches, default first", async () => {
+    const h = handler();
+    const res = await get(h, "/branches");
+    assert.deepEqual(res.body, {
+        branches: [
+            { name: "main", isDefault: true },
+            { name: "docs", isDefault: false },
+            { name: "feature", isDefault: false },
+        ],
+    });
+});
+test("one tarball per commit, however many requests ask", async () => {
+    const h = handler();
+    // The SPA's boot: four requests at once, before anything is cached.
+    await Promise.all([get(h, "/boards"), get(h, "/project"), get(h, "/tasks"), get(h, "/goals")]);
+    await get(h, "/tasks/x7k4m");
+    const tarballs = calls.filter((c) => c.path.includes("/tarball/"));
+    assert.equal(tarballs.length, 1, "the tarball was fetched more than once for one sha");
+    // HEAD is asked every time — that is the freshness check.
+    assert.equal(calls.filter((c) => c.path.includes("/commits/")).length, 5);
+    // Another ref is another commit, hence another tarball; then cached too.
+    await get(h, "/tasks?ref=feature");
+    await get(h, "/tasks?ref=feature");
+    assert.equal(calls.filter((c) => c.path.includes("/tarball/")).length, 2);
+});
+test("the token can be a getter, and no token is a 503 the probe reads as no API", async () => {
+    let minted = 0;
+    const h = handler({
+        token: async () => {
+            minted++;
+            return "ghp_minted";
+        },
+    });
+    assert.equal((await get(h, "/project")).status, 200);
+    assert.equal(minted, 1);
+    assert.equal(calls[0].auth, "Bearer ghp_minted");
+    const unset = handler({ token: () => "" });
+    const res = await get(unset, "/project");
+    assert.equal(res.status, 503);
+    assert.equal(res.body.reason, "no-token");
+});
+test("mounted under a base path, only that path is the API", async () => {
+    const h = handler({ basePath: "/board/api" });
+    assert.equal((await get(h, "/project", "/board/api")).status, 200);
+    assert.equal((await get(h, "/project", "/api")).status, 404);
+    assert.equal((await get(h, "", "/board/api")).status, 404);
+});
+test("GitHub refusing the token is a 502, not a board", async () => {
+    githubStatus = 401;
+    const res = await get(handler(), "/project");
+    assert.equal(res.status, 502);
+    assert.equal(res.body.reason, "github");
+    assert.match(String(res.body.error), /401/);
+});
+test("a repo that isn't owner/name is refused at construction", () => {
+    assert.throws(() => createBoardHandler({ token: "t", repo: "not a repo" }), /owner\/name/);
+    assert.throws(() => createBoardHandler({ token: "t", repo: "a/b/c" }), /owner\/name/);
+});
+//# sourceMappingURL=handler.test.js.map

package/dist/board/handler.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.test.js","sourceRoot":"","sources":["../../src/board/handler.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAqB,MAAM,cAAc,CAAA;AAEpE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,2EAA2E;AAC3E,SAAS,OAAO,CAAC,IAAY,EAAE,KAA6B;IAC1D,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAA;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QAClB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAA;QAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAA;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAClB,EAAE,IAAI,KAAK,CAAC,MAAM,CAAA;IACpB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;AAC1E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,QAAQ,GAAG,CAAC,EAAE,EAAE,CAC7D,gBAAgB,MAAM,eAAe,QAAQ,oFAAoF,KAAK,IAAI,CAAA;AAE5I,kFAAkF;AAClF,MAAM,OAAO,GAA2B,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACpF,MAAM,KAAK,GAA2C;IACpD,GAAG,EAAE;QACH,mBAAmB,EAAE,MAAM;QAC3B,+BAA+B,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC1D,wDAAwD,EACtD,qEAAqE;QACvE,uBAAuB,EACrB,8FAA8F;QAChG,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACnF,mCAAmC,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;KACjE;IACD,GAAG,EAAE;QACH,mBAAmB,EAAE,MAAM;QAC3B,+BAA+B,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC1D,+BAA+B,EAAE,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC,CAAC;KACzE;CACF,CAAA;AAOD,IAAI,KAAK,GAAW,EAAE,CAAA;AACtB,IAAI,YAAY,GAAkB,IAAI,CAAA;AAEtC,SAAS,UAAU,CAAC,KAA6B,EAAE,IAAkB;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACtG,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;IAEjG,MAAM,MAAM,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACrE,OAAO,OAAO,CAAC,OAAO,CACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG;YACH,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE;SAC1F,CAAC,CACH,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACxE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACtE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,8BAA8B,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IAClG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,KAAK,GAAG,EAAE,CAAA;IACV,YAAY,GAAG,IAAI,CAAA;IACnB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;AAC9C,CAAC,CAAC,CAAA;AACF,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;AAElC,SAAS,OAAO,CAAC,QAA2D,EAAE;IAC5E,OAAO,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,CAAe,EAAE,IAAY,EAAE,IAAI,GAAG,MAAM;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,wBAAwB,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAA;IACvE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,EAAE,CAAA;AACpF,CAAC;AAED,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;IAEnB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACxC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC;QAChE,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,EAAE;KACX,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;QAC5B,MAAM,EAAE;YACN,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YACxC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;SAC1C;KACF,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAuC,CAAA;IAC/D,MAAM,CAAC,SAAS,CACd,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EACjD,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAC3B,CAAA;IAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACpC,MAAM,CAAC,SAAS,CAAE,KAAK,CAAC,IAAI,CAAC,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAE9F,6DAA6D;IAC7D,KAAK,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAE,MAAM,CAAC,IAAI,CAAC,IAA0B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACtE,MAAM,CAAC,SAAS,CACb,MAAM,CAAC,IAAI,CAAC,QAAoD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAChG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CACnB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAEhE,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAC/C,MAAM,CAAC,SAAS,CAAE,MAAM,CAAC,IAAI,CAAC,KAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAEtE,wEAAwE;IACxE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AACzD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CACjB,IAAI,OAAO,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC/E,CAAA;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,MAAM,CAAC,KAAK,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC5E,2CAA2C;IAC3C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AAC/B,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;IACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAA;IACjD,MAAM,CAAC,SAAS,CACb,MAAM,CAAC,IAAI,CAAC,KAA+C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EACzF;QACE,CAAC,WAAW,EAAE,MAAM,CAAC;QACrB,CAAC,WAAW,EAAE,MAAM,CAAC;KACtB,CACF,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;IAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAE7C,qEAAqE;IACrE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAA;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;IACpE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;IACnB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IACrC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;QACzB,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;YACjC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;YAClC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE;SACtC;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;IACnB,oEAAoE;IACpE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC9F,MAAM,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;IAClE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,oDAAoD,CAAC,CAAA;IACtF,0DAA0D;IAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACzE,yEAAyE;IACzE,MAAM,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAA;IAClC,MAAM,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAA;IAClC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AAC3E,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAC5F,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,MAAM,CAAC,GAAG,OAAO,CAAC;QAChB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,EAAE,CAAA;YACR,OAAO,YAAY,CAAA;QACrB,CAAC;KACF,CAAC,CAAA;IACF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACvB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;IAEhD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACxC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;AAC3C,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC5D,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IACjE,YAAY,GAAG,GAAG,CAAA;IAClB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;IAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;AAC7C,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,CAAC,CAAA;IAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,CAAC,CAAA;AACvF,CAAC,CAAC,CAAA"}

package/dist/board/pages-function.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The Cloudflare Pages Function `task export --functions` writes.
+ *
+ * Bundled into one dependency-free module (`dist/functions/board.js`, built
+ * by `vite.functions.config.ts`) because the deployed directory has no
+ * `node_modules` — the file has to carry the handler with it. The export
+ * copies it to `functions[/<base>]/api/[[path]].js` and fills in the two
+ * placeholders below; nothing else about it is per-repo.
+ *
+ * The token is read per request from the Pages project's secrets. Unset, the
+ * function answers 503 without touching GitHub: the SPA's boot probe reads
+ * that as "no API" and falls back to the snapshot beside this file, which is
+ * the documented behaviour of a live board that isn't configured yet.
+ */
+/** The secret's name in the Pages project; the README says how to set it. */
+export declare const TOKEN_SECRET = "TASK_GITHUB_TOKEN";
+interface PagesContext {
+    request: Request;
+    env: Record<string, string | undefined>;
+}
+export declare function onRequest(context: PagesContext): Promise<Response> | Response;
+export {};
+//# sourceMappingURL=pages-function.d.ts.map

package/dist/board/pages-function.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages-function.d.ts","sourceRoot":"","sources":["../../src/board/pages-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,6EAA6E;AAC7E,eAAO,MAAM,YAAY,sBAAsB,CAAA;AAE/C,UAAU,YAAY;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACxC;AAKD,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAS7E"}

package/dist/board/pages-function.js

@@ -0,0 +1,34 @@
+/**
+ * The Cloudflare Pages Function `task export --functions` writes.
+ *
+ * Bundled into one dependency-free module (`dist/functions/board.js`, built
+ * by `vite.functions.config.ts`) because the deployed directory has no
+ * `node_modules` — the file has to carry the handler with it. The export
+ * copies it to `functions[/<base>]/api/[[path]].js` and fills in the two
+ * placeholders below; nothing else about it is per-repo.
+ *
+ * The token is read per request from the Pages project's secrets. Unset, the
+ * function answers 503 without touching GitHub: the SPA's boot probe reads
+ * that as "no API" and falls back to the snapshot beside this file, which is
+ * the documented behaviour of a live board that isn't configured yet.
+ */
+import { createBoardHandler } from "./handler.js";
+/** Replaced by `task export` when the file is written. */
+const REPO = "__TASK_EXPORT_REPO__";
+const BASE_PATH = "__TASK_EXPORT_BASE_PATH__";
+/** The secret's name in the Pages project; the README says how to set it. */
+export const TOKEN_SECRET = "TASK_GITHUB_TOKEN";
+let currentToken = "";
+let handler = null;
+export function onRequest(context) {
+    const token = context.env[TOKEN_SECRET];
+    if (!token)
+        return new Response(null, { status: 503 });
+    currentToken = token;
+    // One handler per isolate, so the snapshot cache survives between requests;
+    // the token is read through a getter so a rotated secret takes effect
+    // without waiting for the isolate to be recycled.
+    handler ??= createBoardHandler({ token: () => currentToken, repo: REPO, basePath: BASE_PATH });
+    return handler(context.request);
+}
+//# sourceMappingURL=pages-function.js.map

package/dist/board/pages-function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages-function.js","sourceRoot":"","sources":["../../src/board/pages-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAqB,MAAM,cAAc,CAAA;AAEpE,0DAA0D;AAC1D,MAAM,IAAI,GAAG,sBAAsB,CAAA;AACnC,MAAM,SAAS,GAAG,2BAA2B,CAAA;AAE7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAA;AAO/C,IAAI,YAAY,GAAG,EAAE,CAAA;AACrB,IAAI,OAAO,GAAwB,IAAI,CAAA;AAEvC,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACtD,YAAY,GAAG,KAAK,CAAA;IACpB,4EAA4E;IAC5E,sEAAsE;IACtE,kDAAkD;IAClD,OAAO,KAAK,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;IAC9F,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC"}