@nickmeriano/task 0.11.0 → 0.12.0

package/README.md

@@ -376,7 +376,9 @@ jobs:
   `--force`). Hosted anywhere but a domain root, pass the mount point —
   `task export --base /board/` for `example.com/board/` — so the page knows
   where its assets and snapshot live. Point the host's SPA fallback at
-  `index.html` so deep links resolve.
+  `index.html` so deep links resolve. It also writes a live upgrade for
+  Cloudflare Pages that stays dormant until you add a secret — see "Live data
+  for an exported board" below; `--no-functions` leaves it out.
 - `task serve` is the one command that also looks *down*: run it at a monorepo
   root and it serves every nested board from one server, with a board switcher
   in the header. Run it inside a package and you get just that board. Every
@@ -386,6 +388,178 @@ jobs:
   files (the database stays on disk as an ignored backup) — newer versions
   read only the text format.
 
+## Deploy the board
+
+`task export` writes the board out as plain files, so putting it on the web is
+a CI job and nothing else — no server, no database, no runtime. Cloudflare
+Pages is the path this section walks (per-branch preview URLs come free, and
+the later live upgrade has somewhere to land), but the output is an ordinary
+directory: see "Any static host" below.
+
+```yaml
+# .github/workflows/board.yml
+name: Board
+on: push
+permissions:
+  contents: read
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npx @nickmeriano/task export --out board
+      # The board's routes are real paths (/task/x7k4m), so the host has to
+      # answer them with index.html instead of a 404.
+      - run: echo '/* /index.html 200' > board/_redirects
+      - uses: cloudflare/wrangler-action@v4
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy board --project-name=<your-project> --branch=${{ github.ref_name }}
+```
+
+Three things the workflow can't do for you, once:
+
+1. Create the Pages project (Direct Upload) and use its name for
+   `--project-name`.
+2. Add `CLOUDFLARE_API_TOKEN` as a repository secret — a token with
+   **Pages: Edit** on that account, nothing more.
+3. Add `CLOUDFLARE_ACCOUNT_ID` as a repository secret.
+
+Notes on the shape:
+
+- **`on: push`, every branch, is the point.** A claim is a push, so the
+  deployed board tracks claims at CI latency with no extra machinery — and
+  `--branch=${{ github.ref_name }}` hands each branch its own Pages preview
+  URL, so "the board as this PR would leave it" is a link rather than a
+  checkout.
+- **The `_redirects` line is belt and braces here, and required elsewhere.**
+  `task export` writes `index.html`, `snapshot.json` and `assets/` — it does
+  not write an SPA fallback, and the board's routes are real paths
+  (`/task/<key>`, `/goal/<slug>`). Pages already serves `index.html` for
+  unmatched paths when the output has no `404.html`, so the line changes
+  nothing there; on a host without that default, leaving it out means every
+  deep link 404s while the home page looks fine.
+- **`setup-node` is not decoration.** The package needs Node >= 22.13; without
+  the step you get the runner's default and a confusing failure.
+- **No `--base`.** Pages serves at a domain root, where the default base `/` is
+  right.
+- **The live upgrade is already in the output.** `task export` also writes a
+  `functions/` directory holding a Pages Function that stays dormant until
+  the project has a token — see "Live data for an exported board" below.
+  Turning it on is a secret in the Pages project, never a change to this
+  file.
+
+### Any static host
+
+The output is a directory of static files, so anything that serves those
+works. Two host-side requirements, and they're the whole list:
+
+- **An SPA fallback to `index.html`**, however that host spells it
+  (`_redirects` on Pages and Netlify, a rewrite rule elsewhere). The routes are
+  real paths.
+- **`task export --base /board/`** if you're not serving from a domain root, so
+  the page knows where its assets and snapshot live.
+
+No platform matrix beyond that — there isn't one to write.
+
+### An exported board is as public as wherever you put it
+
+Worth saying plainly, because the export itself has no opinion about it: a
+Pages URL is public even when the repository is private. Anyone with the link
+reads your board.
+
+If that's not what you want, you have two answers. Put the deploy behind your
+own perimeter (Cloudflare Access and the like) — the export doesn't care what's
+in front of it. Or use `task publish`, whose entire point is the other trade:
+GitHub-synced private access, where who can see the board is whoever can see
+the repo.
+
+Which is the shape of the whole picture — same board, three deployments, and
+you pick by how much setup you want:
+
+| | Where it runs | Who can see it | Setup |
+| --- | --- | --- | --- |
+| `task serve` | your machine | you | none |
+| `task export` | any static host | whoever you let | a CI job and a host |
+| `task export` + a token | Cloudflare Pages | whoever you let, live | the same, plus one secret |
+| `task publish` | hosted | whoever can see the repo | one command |
+
+## Live data for an exported board
+
+An export is a snapshot: as fresh as the last CI run, and only of the branch
+it ran on. When that's not enough — you want the board to read the repository
+*now*, or to browse a branch that nobody exported — the same deploy can
+upgrade itself, and the export has already packed what that takes.
+
+Every `task export` writes `functions/api/[[path]].js` beside the static
+files: a Cloudflare Pages Function with the repository baked in (worked out
+from your git remotes; `--repo owner/name` sets it when there isn't one, and
+`--no-functions` leaves the file out). Pages deploys anything under
+`functions/` with the rest of the directory, and other hosts ignore it. It
+does nothing until the host has a token — so the workflow above has already
+deployed it, dormant. To wake it, once:
+
+1. On GitHub, create a **fine-grained personal access token**: *Only select
+   repositories* → this one; *Repository permissions* → **Contents:
+   Read-only**, nothing else. That is the whole permission set the function
+   needs, and the only one you should give it.
+2. In the Pages project's settings, add it as a secret named
+   **`TASK_GITHUB_TOKEN`**.
+
+That's the upgrade. The board's boot probe finds an API answering next to it
+and reads from there instead of `snapshot.json`: the staleness banner is gone,
+every view is the repository's current `.task/`, and the header grows the
+branch switcher — `?ref=<branch>` reads any ref, so a PR's board is a link
+again, the way it is on `task publish`. Until the secret is set (or if it
+expires), the function answers 503, the probe reads that as "no API", and the
+same files serve the snapshot as before. Nobody chooses an architecture up
+front; the deploy is whichever tier it's configured for.
+
+Still read-only, still by construction: the token can only read, and the
+function refuses anything but a GET before it even looks for one.
+
+Two things to know before you turn it on:
+
+- **The token is a person's.** Fine-grained PATs expire (a year at most) and
+  belong to whoever minted them — when they leave, the board goes back to
+  being a snapshot until someone mints a new one. That's the trade for
+  needing no GitHub App of your own.
+- **There is no viewer auth in this tier, and a token makes that matter
+  more.** An exported snapshot is as public as wherever you put it; a live
+  function is *the repository's current `.task/`*, served to anyone who can
+  reach the URL, for as long as the secret is set — including after you stop
+  deploying. `task export` says so in one line every time it writes the file,
+  because the reminder belongs next to the setup. Put the deploy behind your
+  own perimeter (Cloudflare Access and the like), or use `task publish`, whose
+  whole point is GitHub-synced access without a token of your own.
+
+### Any other host
+
+The function is a three-line adapter around an exported handler. Anything
+that can run a `(Request) => Promise<Response>` — a Netlify function, a Deno
+or Bun server, a Worker of your own — gets the same live board:
+
+```ts
+import { createBoardHandler } from "@nickmeriano/task"
+
+const board = createBoardHandler({
+  token: process.env.TASK_GITHUB_TOKEN!,   // or an async getter that mints one
+  repo: "owner/name",
+  basePath: "/api",                        // where you mount it: `<base>api`
+})
+export default { fetch: (request: Request) => board(request) }
+```
+
+Mount it at `<base>api` — `/api` at a domain root, `/board/api` under
+`task export --base /board/` — and the SPA finds it the same way. `token` may
+be a function returning a promise, so an adapter that would rather mint an
+installation token from its own GitHub App can, without this package knowing
+anything about App auth.
+
 ## How it's built
 
 - **Zero dependencies.** Storage is markdown files with a tiny frontmatter

package/dist/board/github.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Reading a repository from GitHub, with a bearer token and nothing else.
+ *
+ * This is the read half of the hosted board's `worker/github.ts`, moved here
+ * so an exported board's live proxy (`handler.ts`) and the hosted worker read
+ * a repository through the same four calls. What deliberately did *not* move
+ * with it: everything that mints or exchanges a credential — App JWTs,
+ * installation tokens, the viewer's OAuth flow. Those are the hosted
+ * product's auth surface and stay in the worker; here a token is a string
+ * somebody already holds (a fine-grained PAT, an installation token the
+ * worker minted), and this module only ever spends it on reads.
+ *
+ * Web-standard only — `fetch`, `Response`, `DecompressionStream` — so the same
+ * source runs under Node 22, a Cloudflare Worker, and a Pages Function.
+ */
+import { type TarContents } from "./tar.ts";
+export declare class GitHubError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface RepoInfo {
+    defaultBranch: string;
+    private: boolean;
+}
+export declare function repoInfo(token: string, owner: string, repo: string): Promise<RepoInfo>;
+/**
+ * Branch names, for the board's branch switcher. One page of 100: a selector
+ * over more branches than that stops being a selector, and the switcher's
+ * search box only filters what's listed. Sorting is the caller's job — it
+ * knows the default branch; this endpoint doesn't.
+ */
+export declare function listBranches(token: string, owner: string, repo: string): Promise<string[]>;
+/** A commit's identity, so the board can say how fresh it is. */
+export interface CommitInfo {
+    sha: string;
+    committedAt: string;
+    message: string;
+}
+export declare function headCommit(token: string, owner: string, repo: string, ref: string): Promise<CommitInfo>;
+/**
+ * Did GitHub just say "that ref doesn't exist"?
+ *
+ * It says it two different ways, and the obvious one is the rarer one. Asking
+ * `/repos/{o}/{r}/commits/{ref}` for a branch that isn't there answers **422**
+ * ("No commit found for SHA: …"), not 404 — 404 is what you get when the
+ * repository itself is out of reach. Checking only for 404 let every dead
+ * `?ref=` link fall through to a generic "GitHub is unhappy — try again"
+ * screen: a retry prompt for something no amount of retrying will fix.
+ */
+export declare function isMissingRef(error: unknown): boolean;
+/**
+ * The whole repository at `sha`, in one request: every file path, plus the
+ * bytes of the paths `keep` selects.
+ *
+ * This replaced two earlier shapes, each broken by arithmetic. Per-file
+ * contents reads were one subrequest per ticket, against the 50-subrequest
+ * ceiling Workers get on the free plan — every cold board view of this repo
+ * 500'd. Batched GraphQL blob reads fixed that, but still cost one tree
+ * listing plus one request per 80 files, scaling with board size. A tarball
+ * is a single request whatever the repo holds, and it carries the path
+ * listing too. Streamed through gzip and a tar walk, keeping bytes only for
+ * `keep`-selected paths, so memory is bounded by the boards rather than the
+ * repository.
+ *
+ * The tarball endpoint answers with a redirect to codeload; fetch follows it.
+ */
+export declare function fetchRepoArchive(token: string, owner: string, repo: string, sha: string, keep: (path: string) => boolean): Promise<TarContents>;
+//# sourceMappingURL=github.d.ts.map

package/dist/board/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/board/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAO9D,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK5C;AAcD,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAM5F;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMhG;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,CAUrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC9B,OAAO,CAAC,WAAW,CAAC,CAmBtB"}

package/dist/board/github.js

@@ -0,0 +1,112 @@
+/**
+ * Reading a repository from GitHub, with a bearer token and nothing else.
+ *
+ * This is the read half of the hosted board's `worker/github.ts`, moved here
+ * so an exported board's live proxy (`handler.ts`) and the hosted worker read
+ * a repository through the same four calls. What deliberately did *not* move
+ * with it: everything that mints or exchanges a credential — App JWTs,
+ * installation tokens, the viewer's OAuth flow. Those are the hosted
+ * product's auth surface and stay in the worker; here a token is a string
+ * somebody already holds (a fine-grained PAT, an installation token the
+ * worker minted), and this module only ever spends it on reads.
+ *
+ * Web-standard only — `fetch`, `Response`, `DecompressionStream` — so the same
+ * source runs under Node 22, a Cloudflare Worker, and a Pages Function.
+ */
+import { readTar, TarError } from "./tar.js";
+const API = "https://api.github.com";
+/** Sent on every call; GitHub rejects requests without a User-Agent. */
+const UA = "@nickmeriano/task";
+export class GitHubError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = "GitHubError";
+        this.status = status;
+    }
+}
+async function apiGet(token, path) {
+    const res = await fetch(`${API}${path}`, {
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/vnd.github+json",
+            "User-Agent": UA,
+        },
+    });
+    if (!res.ok)
+        throw new GitHubError(res.status, `GET ${path} failed (${res.status})`);
+    return (await res.json());
+}
+export async function repoInfo(token, owner, repo) {
+    const data = await apiGet(token, `/repos/${owner}/${repo}`);
+    return { defaultBranch: data.default_branch, private: data.private };
+}
+/**
+ * Branch names, for the board's branch switcher. One page of 100: a selector
+ * over more branches than that stops being a selector, and the switcher's
+ * search box only filters what's listed. Sorting is the caller's job — it
+ * knows the default branch; this endpoint doesn't.
+ */
+export async function listBranches(token, owner, repo) {
+    const data = await apiGet(token, `/repos/${owner}/${repo}/branches?per_page=100`);
+    return data.map((branch) => branch.name);
+}
+export async function headCommit(token, owner, repo, ref) {
+    const data = await apiGet(token, `/repos/${owner}/${repo}/commits/${encodeURIComponent(ref)}`);
+    return {
+        sha: data.sha,
+        committedAt: data.commit.committer.date,
+        message: data.commit.message.split("\n")[0],
+    };
+}
+/**
+ * Did GitHub just say "that ref doesn't exist"?
+ *
+ * It says it two different ways, and the obvious one is the rarer one. Asking
+ * `/repos/{o}/{r}/commits/{ref}` for a branch that isn't there answers **422**
+ * ("No commit found for SHA: …"), not 404 — 404 is what you get when the
+ * repository itself is out of reach. Checking only for 404 let every dead
+ * `?ref=` link fall through to a generic "GitHub is unhappy — try again"
+ * screen: a retry prompt for something no amount of retrying will fix.
+ */
+export function isMissingRef(error) {
+    return error instanceof GitHubError && (error.status === 404 || error.status === 422);
+}
+/**
+ * The whole repository at `sha`, in one request: every file path, plus the
+ * bytes of the paths `keep` selects.
+ *
+ * This replaced two earlier shapes, each broken by arithmetic. Per-file
+ * contents reads were one subrequest per ticket, against the 50-subrequest
+ * ceiling Workers get on the free plan — every cold board view of this repo
+ * 500'd. Batched GraphQL blob reads fixed that, but still cost one tree
+ * listing plus one request per 80 files, scaling with board size. A tarball
+ * is a single request whatever the repo holds, and it carries the path
+ * listing too. Streamed through gzip and a tar walk, keeping bytes only for
+ * `keep`-selected paths, so memory is bounded by the boards rather than the
+ * repository.
+ *
+ * The tarball endpoint answers with a redirect to codeload; fetch follows it.
+ */
+export async function fetchRepoArchive(token, owner, repo, sha, keep) {
+    const res = await fetch(`${API}/repos/${owner}/${repo}/tarball/${encodeURIComponent(sha)}`, {
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/vnd.github+json",
+            "User-Agent": UA,
+        },
+    });
+    if (!res.ok || !res.body) {
+        throw new GitHubError(res.status, `could not read the repository archive (${res.status})`);
+    }
+    try {
+        return await readTar(res.body.pipeThrough(new DecompressionStream("gzip")), keep);
+    }
+    catch (error) {
+        if (error instanceof TarError) {
+            throw new GitHubError(502, `could not read the repository archive (${error.message})`);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=github.js.map

package/dist/board/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/board/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAoB,MAAM,UAAU,CAAA;AAE9D,MAAM,GAAG,GAAG,wBAAwB,CAAA;AAEpC,wEAAwE;AACxE,MAAM,EAAE,GAAG,mBAAmB,CAAA;AAE9B,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAQ;IACvB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED,KAAK,UAAU,MAAM,CAAI,KAAa,EAAE,IAAY;IAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;QACvC,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,EAAE;SACjB;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IACpF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;AAChC,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY;IACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,KAAK,EACL,UAAU,KAAK,IAAI,IAAI,EAAE,CAC1B,CAAA;IACD,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY;IAC3E,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,KAAK,EACL,UAAU,KAAK,IAAI,IAAI,wBAAwB,CAChD,CAAA;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAC1C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,MAAM,CAGtB,KAAK,EAAE,UAAU,KAAK,IAAI,IAAI,YAAY,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACvE,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI;QACvC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC5C,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,KAAa,EACb,IAAY,EACZ,GAAW,EACX,IAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,UAAU,KAAK,IAAI,IAAI,YAAY,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE;QAC1F,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,EAAE;SACjB;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,0CAA0C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,0CAA0C,KAAK,CAAC,OAAO,GAAG,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/board/handler.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The live proxy: an exported board's API, as one fetch handler.
+ *
+ * `task export` ships the board as static files plus a baked `snapshot.json`.
+ * Drop this next to them — as a Cloudflare Pages Function, or behind any host
+ * that can run a `(Request) => Response` — hand it a token, and the same
+ * files become a live board: the SPA probes for an API before it mounts,
+ * finds this one answering, and never reads the snapshot at all. No token,
+ * no function, and the probe fails and the snapshot is what you get. The
+ * upgrade is the deploy, not a rebuild.
+ *
+ * The routes are `task serve`'s read routes — the same ones the snapshot
+ * answers (`ui/src/snapshot.ts`), plus the two things a live proxy is *for*:
+ * `?ref=` to read any branch, and `/branches` so the switcher has something to
+ * list. Payloads come from `source.ts`, which is what the hosted board serves,
+ * so a board rendered from this differs from the hosted one in one thing:
+ * who may look. This tier has no viewer auth — the perimeter is wherever you
+ * deploy it — and it says so in `/project` the only way the SPA reads:
+ * `readOnly: true`, no `git` capability.
+ *
+ * Read-only by construction: anything but GET is a 405 before a token is
+ * even resolved.
+ */
+export interface BoardHandlerOptions {
+    /**
+     * A bearer token GitHub will accept for reading the repository — a
+     * fine-grained PAT with `Contents: Read-only` on this one repo is the
+     * shape the README walks through — or a function that produces one, for
+     * an adapter that mints its own (an installation token, say). Called per
+     * request; cache in the getter if minting is expensive.
+     */
+    token: string | (() => string | Promise<string>);
+    /** `owner/name`. */
+    repo: string;
+    /** What a request with no `?ref=` reads. Default `HEAD`: the default branch. */
+    ref?: string;
+    /**
+     * Where the handler is mounted, so it can strip the prefix off incoming
+     * paths. `task export` writes `<base>api` here — `/api` at a domain root,
+     * `/board/api` under `--base /board/` — matching where the SPA looks.
+     */
+    basePath?: string;
+    /** Snapshots kept in memory, by commit. Default 24. */
+    maxCachedSnapshots?: number;
+}
+export type BoardHandler = (request: Request) => Promise<Response>;
+/** `owner/name`, both halves as GitHub spells them. */
+export declare const REPO_PATTERN: RegExp;
+export declare function createBoardHandler(options: BoardHandlerOptions): BoardHandler;
+//# sourceMappingURL=handler.d.ts.map

package/dist/board/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/board/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAYH,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAChD,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAIlE,uDAAuD;AACvD,eAAO,MAAM,YAAY,QAAuB,CAAA;AAoBhD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAiJ7E"}

package/dist/board/handler.js

@@ -0,0 +1,183 @@
+/**
+ * The live proxy: an exported board's API, as one fetch handler.
+ *
+ * `task export` ships the board as static files plus a baked `snapshot.json`.
+ * Drop this next to them — as a Cloudflare Pages Function, or behind any host
+ * that can run a `(Request) => Response` — hand it a token, and the same
+ * files become a live board: the SPA probes for an API before it mounts,
+ * finds this one answering, and never reads the snapshot at all. No token,
+ * no function, and the probe fails and the snapshot is what you get. The
+ * upgrade is the deploy, not a rebuild.
+ *
+ * The routes are `task serve`'s read routes — the same ones the snapshot
+ * answers (`ui/src/snapshot.ts`), plus the two things a live proxy is *for*:
+ * `?ref=` to read any branch, and `/branches` so the switcher has something to
+ * list. Payloads come from `source.ts`, which is what the hosted board serves,
+ * so a board rendered from this differs from the hosted one in one thing:
+ * who may look. This tier has no viewer auth — the perimeter is wherever you
+ * deploy it — and it says so in `/project` the only way the SPA reads:
+ * `readOnly: true`, no `git` capability.
+ *
+ * Read-only by construction: anything but GET is a 405 before a token is
+ * even resolved.
+ */
+import { GitHubError, headCommit, isMissingRef, listBranches, repoInfo } from "./github.js";
+import { BoardSourceError, SnapshotMemory, STATUSES, snapshotAt, } from "./source.js";
+const REF_PATTERN = /^[\w.\-/]{1,255}$/;
+/** `owner/name`, both halves as GitHub spells them. */
+export const REPO_PATTERN = /^[\w.-]+\/[\w.-]+$/;
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "Content-Type": "application/json; charset=utf-8",
+            // Every answer is "the repository right now"; nothing between this
+            // function and the browser should hold on to one.
+            "Cache-Control": "no-store",
+        },
+    });
+}
+/** The board the request asked for, or the repo's default — `pickBoard`'s rule. */
+function pickBoard(snapshot, requested) {
+    const id = requested && snapshot.data.has(requested) ? requested : snapshot.boards[0]?.id;
+    return id === undefined ? null : (snapshot.data.get(id) ?? null);
+}
+export function createBoardHandler(options) {
+    const { repo: slug, ref: defaultRef = "HEAD" } = options;
+    if (!REPO_PATTERN.test(slug))
+        throw new Error(`repo must be owner/name — got ${JSON.stringify(slug)}`);
+    const [owner, repo] = slug.split("/");
+    const basePath = (options.basePath ?? "/api").replace(/\/+$/, "");
+    const memory = new SnapshotMemory(options.maxCachedSnapshots);
+    // A cold start sees the SPA's four boot requests at once, all for the same
+    // commit. One tarball, not four: the first caller's load is shared with
+    // everyone who asks for that sha while it is still in flight.
+    const inFlight = new Map();
+    async function resolveToken() {
+        const token = typeof options.token === "function" ? await options.token() : options.token;
+        if (!token) {
+            // Unconfigured is not an error the board can act on; it is "no API",
+            // and a 5xx is exactly what makes the SPA's probe fall back to the
+            // snapshot sitting next to this function.
+            throw new BoardSourceError(503, "no GitHub token configured for the live board", "no-token");
+        }
+        return token;
+    }
+    async function load(token, ref, explicit) {
+        let commit;
+        try {
+            commit = await headCommit(token, owner, repo, ref);
+        }
+        catch (error) {
+            // With an explicit ref, a miss almost always means the branch — a
+            // deleted preview, a typo — not the repository.
+            if (explicit && isMissingRef(error)) {
+                throw new BoardSourceError(404, `no such branch or ref: ${ref}`, "no-such-ref");
+            }
+            throw error;
+        }
+        const key = `${owner}/${repo}@${commit.sha}`;
+        const cached = memory.get(key);
+        if (cached)
+            return cached;
+        let pending = inFlight.get(key);
+        if (!pending) {
+            pending = snapshotAt(token, owner, repo, commit, ref)
+                .then((snapshot) => memory.remember(key, snapshot))
+                .finally(() => inFlight.delete(key));
+            inFlight.set(key, pending);
+        }
+        return pending;
+    }
+    async function handle(request) {
+        if (request.method !== "GET" && request.method !== "HEAD") {
+            // Every editing affordance is already hidden by `readOnly`; this is the
+            // backstop, in the shape `ApiError` reads.
+            return json({ error: "this board is read-only — commit and push to change it", reason: "read-only" }, 405);
+        }
+        const url = new URL(request.url);
+        if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) {
+            return json({ error: `not an API path: ${url.pathname}` }, 404);
+        }
+        const route = url.pathname.slice(basePath.length) || "/";
+        const token = await resolveToken();
+        if (route === "/branches") {
+            // Default branch first (it's the way back), then alphabetical — the
+            // hosted board's order, which is the order the switcher expects.
+            const [names, info] = await Promise.all([
+                listBranches(token, owner, repo),
+                repoInfo(token, owner, repo),
+            ]);
+            const branches = names
+                .map((name) => ({ name, isDefault: name === info.defaultBranch }))
+                .sort((a, b) => Number(b.isDefault) - Number(a.isDefault) || a.name.localeCompare(b.name));
+            return json({ branches });
+        }
+        // A ref is a viewer-supplied string that lands in a URL path; anything
+        // outside git's own naming rules is ignored rather than escaped.
+        const requestedRef = url.searchParams.get("ref");
+        const ref = requestedRef && REF_PATTERN.test(requestedRef) && !requestedRef.includes("..")
+            ? requestedRef
+            : null;
+        const snapshot = await load(token, ref ?? defaultRef, ref !== null);
+        if (route === "/boards")
+            return json({ boards: snapshot.boards });
+        const board = pickBoard(snapshot, url.searchParams.get("board"));
+        if (!board)
+            return json({ error: "no such board" }, 404);
+        if (route === "/project") {
+            return json({
+                name: board.info.name,
+                prefix: board.info.prefix,
+                statuses: STATUSES,
+                // The payload the SPA reads to decide whether to offer editing at all.
+                // The data is a commit; the only way to change one is to push.
+                readOnly: true,
+                // Locally this is who would author a comment. Nothing here can
+                // comment, and nothing here knows who is looking.
+                author: "",
+            });
+        }
+        if (route === "/tasks")
+            return json({ tasks: board.tasks });
+        if (route === "/goals")
+            return json({ goals: board.goals });
+        const detail = /^\/tasks\/([^/]+)$/.exec(route);
+        if (detail) {
+            // The CLI accepts "PREFIX-x7k4m" or "x7k4m"; so does this.
+            const match = /^(?:[A-Za-z0-9]+-)?([A-Za-z0-9]+)$/.exec(decodeURIComponent(detail[1]));
+            if (!match)
+                return json({ error: "invalid task id" }, 400);
+            const key = match[1].toLowerCase();
+            const task = board.tasks.find((candidate) => candidate.key === key);
+            if (!task)
+                return json({ error: `no such task: ${key}` }, 404);
+            return json({ task, comments: board.comments.get(key) ?? [] });
+        }
+        // `/inbox` and the git surface are deliberately absent: the SPA degrades
+        // to no inbox and no git chrome when they 404, same as the hosted board.
+        return json({ error: `not here: ${route}` }, 404);
+    }
+    return async (request) => {
+        try {
+            return await handle(request);
+        }
+        catch (error) {
+            if (error instanceof BoardSourceError) {
+                return json({ error: error.message, reason: error.reason }, error.status);
+            }
+            if (error instanceof GitHubError) {
+                // A bad or expired token, a repo the token can't see, GitHub itself
+                // down: all of them are "the live board can't answer right now". A
+                // 5xx is deliberate — on the boot probe it is what sends the SPA to
+                // the snapshot instead of an error screen.
+                return json({
+                    error: `GitHub answered ${error.status} — check the token and the repository name`,
+                    reason: "github",
+                }, 502);
+            }
+            return json({ error: error instanceof Error ? error.message : "internal error" }, 500);
+        }
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/board/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/board/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3F,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,UAAU,GAGX,MAAM,aAAa,CAAA;AA2BpB,MAAM,WAAW,GAAG,mBAAmB,CAAA;AAEvC,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,mEAAmE;YACnE,kDAAkD;YAClD,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAA;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,QAAkB,EAAE,SAAwB;IAC7D,MAAM,EAAE,GAAG,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IACzF,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,EAAE,GAAG,OAAO,CAAA;IACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC7D,2EAA2E;IAC3E,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAA;IAErD,KAAK,UAAU,YAAY;QACzB,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QACzF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,+CAA+C,EAAE,UAAU,CAAC,CAAA;QAC9F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,GAAW,EAAE,QAAiB;QAC/D,IAAI,MAAM,CAAA;QACV,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,gDAAgD;YAChD,IAAI,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,0BAA0B,GAAG,EAAE,EAAE,aAAa,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;iBAClD,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;iBAClD,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YACtC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5B,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,wEAAwE;YACxE,2CAA2C;YAC3C,OAAO,IAAI,CACT,EAAE,KAAK,EAAE,wDAAwD,EAAE,MAAM,EAAE,WAAW,EAAE,EACxF,GAAG,CACJ,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACxD,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;QAElC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACtC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;gBAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;aAC7B,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,KAAK;iBACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;iBACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YAC5F,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3B,CAAC;QAED,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAChD,MAAM,GAAG,GACP,YAAY,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC5E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,CAAA;QACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,UAAU,EAAE,GAAG,KAAK,IAAI,CAAC,CAAA;QAEnE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAEjE,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAExD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,uEAAuE;gBACvE,+DAA+D;gBAC/D,QAAQ,EAAE,IAAI;gBACd,+DAA+D;gBAC/D,kDAAkD;gBAClD,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3D,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAE3D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,2DAA2D;YAC3D,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACtF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;YAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACnE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YAC9D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAChE,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,2CAA2C;gBAC3C,OAAO,IAAI,CACT;oBACE,KAAK,EAAE,mBAAmB,KAAK,CAAC,MAAM,4CAA4C;oBAClF,MAAM,EAAE,QAAQ;iBACjB,EACD,GAAG,CACJ,CAAA;YACH,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/board/handler.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The live proxy, against a fake GitHub.
+ *
+ * `globalThis.fetch` is replaced with a tiny router that answers the four
+ * calls the handler makes — head commit, tarball, branches, repo info — from
+ * an in-memory repository, so what's under test is the handler's routing,
+ * caching and error shapes, not the network. The payloads themselves are
+ * pinned elsewhere (`source.test.ts` diffs them against the CLI's store).
+ */
+export {};
+//# sourceMappingURL=handler.test.d.ts.map

package/dist/board/handler.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.test.d.ts","sourceRoot":"","sources":["../../src/board/handler.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}