@nickmeriano/task 0.11.0 → 0.12.0

package/dist/board/tar.js

@@ -0,0 +1,188 @@
+/**
+ * A minimal streaming tar reader — just enough to walk a GitHub repository
+ * tarball. One pass, bounded memory: every entry's *path* is recorded, but
+ * bytes are kept only for the paths the caller's `keep` predicate selects;
+ * everything else is discarded chunk by chunk as it streams through, so a big
+ * repository costs no more memory than its boards.
+ *
+ * Understands what GitHub's tarballs actually contain: ustar headers with the
+ * split `prefix` field, a leading `pax_global_header`, and pax extended
+ * headers (`x`) or GNU longname entries (`L`) for paths longer than the
+ * header's 100 bytes. Checksums are not verified — the bytes come off a TLS
+ * connection from GitHub, not a tape from 1988.
+ */
+export class TarError extends Error {
+}
+const BLOCK = 512;
+/** Reads exact byte counts off a stream, buffering only what's unconsumed. */
+class ByteReader {
+    reader;
+    chunks = [];
+    have = 0;
+    done = false;
+    constructor(stream) {
+        this.reader = stream.getReader();
+    }
+    async pull() {
+        if (this.done)
+            return false;
+        const { done, value } = await this.reader.read();
+        if (done) {
+            this.done = true;
+            return false;
+        }
+        if (value && value.length > 0) {
+            this.chunks.push(value);
+            this.have += value.length;
+        }
+        return true;
+    }
+    /** Exactly `n` bytes; null at a clean end-of-stream, throws mid-entry. */
+    async read(n) {
+        while (this.have < n) {
+            if (!(await this.pull())) {
+                if (this.have === 0)
+                    return null;
+                throw new TarError("truncated archive");
+            }
+        }
+        const out = new Uint8Array(n);
+        let filled = 0;
+        while (filled < n) {
+            const head = this.chunks[0];
+            const take = Math.min(head.length, n - filled);
+            out.set(head.subarray(0, take), filled);
+            filled += take;
+            if (take === head.length)
+                this.chunks.shift();
+            else
+                this.chunks[0] = head.subarray(take);
+        }
+        this.have -= n;
+        return out;
+    }
+    /** Discard `n` bytes without accumulating them. */
+    async skip(n) {
+        while (n > 0) {
+            if (this.chunks.length === 0) {
+                if (!(await this.pull()))
+                    throw new TarError("truncated archive");
+                continue;
+            }
+            const head = this.chunks[0];
+            const take = Math.min(head.length, n);
+            if (take === head.length)
+                this.chunks.shift();
+            else
+                this.chunks[0] = head.subarray(take);
+            this.have -= take;
+            n -= take;
+        }
+    }
+}
+const decoder = new TextDecoder();
+function field(header, start, length) {
+    const slice = header.subarray(start, start + length);
+    const nul = slice.indexOf(0);
+    return decoder.decode(nul < 0 ? slice : slice.subarray(0, nul));
+}
+function octal(header, start, length) {
+    const text = field(header, start, length).trim();
+    if (text === "")
+        return 0;
+    const value = parseInt(text, 8);
+    if (Number.isNaN(value) || value < 0)
+        throw new TarError("bad size field");
+    return value;
+}
+/** The `path=` record of a pax extended header, if it has one. */
+function paxPath(data) {
+    // Records are "<len> <key>=<value>\n", len covering the whole record.
+    const text = decoder.decode(data);
+    for (let at = 0; at < text.length;) {
+        const space = text.indexOf(" ", at);
+        if (space < 0)
+            break;
+        const length = Number(text.slice(at, space));
+        if (!Number.isInteger(length) || length <= 0)
+            break;
+        const record = text.slice(space + 1, at + length);
+        if (record.startsWith("path="))
+            return record.slice(5).replace(/\n$/, "");
+        at += length;
+    }
+    return null;
+}
+/**
+ * Walk a (decompressed) tar stream. Paths are reported with the archive's
+ * root directory stripped — GitHub tarballs wrap everything in
+ * `<owner>-<repo>-<sha>/` — matching what a git tree listing would say.
+ */
+export async function readTar(stream, keep) {
+    const bytes = new ByteReader(stream);
+    const paths = [];
+    const files = new Map();
+    let overridePath = null;
+    for (;;) {
+        const header = await bytes.read(BLOCK);
+        if (header === null)
+            break;
+        if (header.every((b) => b === 0)) {
+            // End marker: two zero blocks, then maybe padding. Nothing left to parse.
+            break;
+        }
+        const size = octal(header, 124, 12);
+        const padded = Math.ceil(size / BLOCK) * BLOCK;
+        const type = header[156];
+        // Extended headers name the *next* entry; the global one ('g') is skipped.
+        if (type === 0x78 /* x */ || type === 0x4c /* L */) {
+            const data = await bytes.read(size);
+            if (data === null)
+                throw new TarError("truncated archive");
+            overridePath =
+                type === 0x78 ? (paxPath(data) ?? overridePath) : decoder.decode(data).replace(/\0+$/, "");
+            await bytes.skip(padded - size);
+            continue;
+        }
+        let name = field(header, 0, 100);
+        // ustar splits long paths into prefix + name.
+        const prefix = field(header, 257, 6).startsWith("ustar") ? field(header, 345, 155) : "";
+        if (prefix)
+            name = `${prefix}/${name}`;
+        if (overridePath !== null) {
+            name = overridePath;
+            overridePath = null;
+        }
+        // Regular file entries only — directories, links and the global header
+        // carry no board bytes. Type '0' or the ancient NUL both mean "file".
+        if (type !== 0x30 && type !== 0) {
+            await bytes.skip(padded);
+            continue;
+        }
+        // Strip the tarball's root directory. A path without one (no slash) is
+        // the metadata GitHub puts at the top level — not repository content.
+        const slash = name.indexOf("/");
+        if (slash < 0) {
+            await bytes.skip(padded);
+            continue;
+        }
+        const path = name.slice(slash + 1);
+        if (path === "") {
+            await bytes.skip(padded);
+            continue;
+        }
+        paths.push(path);
+        if (keep(path)) {
+            const data = await bytes.read(size);
+            if (data === null)
+                throw new TarError("truncated archive");
+            files.set(path, data);
+            await bytes.skip(padded - size);
+        }
+        else {
+            await bytes.skip(padded);
+        }
+    }
+    return { paths, files };
+}
+//# sourceMappingURL=tar.js.map

package/dist/board/tar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../../src/board/tar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,OAAO,QAAS,SAAQ,KAAK;CAAG;AAEtC,MAAM,KAAK,GAAG,GAAG,CAAA;AAEjB,8EAA8E;AAC9E,MAAM,UAAU;IACN,MAAM,CAAyC;IAC/C,MAAM,GAAiB,EAAE,CAAA;IACzB,IAAI,GAAG,CAAC,CAAA;IACR,IAAI,GAAG,KAAK,CAAA;IAEpB,YAAY,MAAkC;QAC5C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAClC,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAChD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAChB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;QAC3B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,CAAS;QAClB,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBAChC,MAAM,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAAA;YACzC,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,OAAO,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAA;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YACvC,MAAM,IAAI,IAAI,CAAA;YACd,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;;gBACxC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA;QACd,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,IAAI,CAAC,CAAS;QAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAAA;gBACjE,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;;gBACxC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YACzC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAA;YACjB,CAAC,IAAI,IAAI,CAAA;QACX,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,KAAK,CAAC,MAAkB,EAAE,KAAa,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,MAAkB,EAAE,KAAa,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,CAAA;IACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAC1E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,kEAAkE;AAClE,SAAS,OAAO,CAAC,IAAgB;IAC/B,sEAAsE;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACjC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,GAAI,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAK;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;YAAE,MAAK;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAA;QACjD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACzE,EAAE,IAAI,MAAM,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAkC,EAClC,IAA+B;IAE/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IAE3C,IAAI,YAAY,GAAkB,IAAI,CAAA;IACtC,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAK;QAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjC,0EAA0E;YAC1E,MAAK;QACP,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAExB,2EAA2E;QAC3E,IAAI,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAAA;YAC1D,YAAY;gBACV,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC5F,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;YAC/B,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;QAChC,8CAA8C;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACvF,IAAI,MAAM;YAAE,IAAI,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAA;QACtC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,GAAG,YAAY,CAAA;YACnB,YAAY,GAAG,IAAI,CAAA;QACrB,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxB,SAAQ;QACV,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxB,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAClC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxB,SAAQ;QACV,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAAA;YAC1D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACrB,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AACzB,CAAC"}

package/dist/board/tar.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The tar walk is hand-written against a binary format, so it's tested the
+ * way the SQLite reader used to be: against archives built independently —
+ * here by a minimal tar *writer* that produces the same shapes GitHub's
+ * tarballs contain (ustar headers, a pax_global_header, pax path overrides,
+ * a wrapping root directory), gzipped through node:zlib.
+ */
+export {};
+//# sourceMappingURL=tar.test.d.ts.map

package/dist/board/tar.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.test.d.ts","sourceRoot":"","sources":["../../src/board/tar.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/board/tar.test.js

@@ -0,0 +1,110 @@
+/**
+ * The tar walk is hand-written against a binary format, so it's tested the
+ * way the SQLite reader used to be: against archives built independently —
+ * here by a minimal tar *writer* that produces the same shapes GitHub's
+ * tarballs contain (ustar headers, a pax_global_header, pax path overrides,
+ * a wrapping root directory), gzipped through node:zlib.
+ */
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { gzipSync } from "node:zlib";
+import { readTar, TarError } from "./tar.js";
+const encoder = new TextEncoder();
+function header(name, type, size) {
+    const block = new Uint8Array(512);
+    block.set(encoder.encode(name).subarray(0, 100), 0);
+    block.set(encoder.encode("0000644\0"), 100);
+    block.set(encoder.encode(size.toString(8).padStart(11, "0") + "\0"), 124);
+    block.set(encoder.encode("00000000000\0"), 136);
+    block[156] = type.charCodeAt(0);
+    block.set(encoder.encode("ustar\x0000"), 257);
+    // Checksum: field treated as spaces while summing.
+    block.set(encoder.encode("        "), 148);
+    const sum = block.reduce((a, b) => a + b, 0);
+    block.set(encoder.encode(sum.toString(8).padStart(6, "0") + "\0 "), 148);
+    return block;
+}
+function tarball(entries) {
+    const blocks = [];
+    for (const entry of entries) {
+        if (entry.paxPath) {
+            const record = ` path=${entry.paxPath}\n`;
+            const body = `${record.length + String(record.length + 2).length}${record}`;
+            const bytes = encoder.encode(body);
+            blocks.push(header("./PaxHeaders/x", "x", bytes.length), pad(bytes));
+        }
+        const data = encoder.encode(entry.data ?? "");
+        blocks.push(header(entry.name, entry.type ?? "0", data.length));
+        if (data.length > 0)
+            blocks.push(pad(data));
+    }
+    blocks.push(new Uint8Array(1024));
+    const total = blocks.reduce((n, b) => n + b.length, 0);
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const block of blocks) {
+        out.set(block, at);
+        at += block.length;
+    }
+    return out;
+}
+function pad(data) {
+    const padded = new Uint8Array(Math.ceil(data.length / 512) * 512);
+    padded.set(data);
+    return padded;
+}
+function stream(bytes) {
+    return new Response(gzipSync(bytes)).body.pipeThrough(new DecompressionStream("gzip"));
+}
+test("walks a GitHub-shaped tarball: root stripped, kept bytes kept, rest skipped", async () => {
+    const bytes = tarball([
+        { name: "pax_global_header", type: "g", data: "52 comment=1234\n" },
+        { name: "owner-repo-abc123/", type: "5" },
+        { name: "owner-repo-abc123/README.md", data: "# hi" },
+        { name: "owner-repo-abc123/.task/config.json", data: '{"name":"x","prefix":"X","version":2}' },
+        { name: "owner-repo-abc123/.task/tickets/1/ticket.md", data: "---\nstatus: todo\n---\n\n# T\n" },
+        { name: "owner-repo-abc123/big/blob.bin", data: "z".repeat(5000) },
+        { name: "owner-repo-abc123/pkg/.task/config.json", data: "{}" },
+    ]);
+    const { paths, files } = await readTar(stream(bytes), (path) => path.includes(".task/"));
+    assert.deepEqual(paths, [
+        "README.md",
+        ".task/config.json",
+        ".task/tickets/1/ticket.md",
+        "big/blob.bin",
+        "pkg/.task/config.json",
+    ]);
+    assert.deepEqual([...files.keys()], [
+        ".task/config.json",
+        ".task/tickets/1/ticket.md",
+        "pkg/.task/config.json",
+    ]);
+    assert.equal(new TextDecoder().decode(files.get(".task/tickets/1/ticket.md")), "---\nstatus: todo\n---\n\n# T\n");
+});
+test("pax path records override the header name, as GitHub does for long paths", async () => {
+    const longPath = `owner-repo-abc123/${"deeply/".repeat(20)}.task/config.json`;
+    const bytes = tarball([
+        { name: "owner-repo-abc123/x", paxPath: longPath, data: "{}" },
+    ]);
+    const { paths, files } = await readTar(stream(bytes), () => true);
+    assert.deepEqual(paths, [longPath.slice("owner-repo-abc123/".length)]);
+    assert.equal(files.size, 1);
+});
+test("ustar prefix fields are joined back onto the name", async () => {
+    const bytes = tarball([{ name: "owner-repo-abc123/plain.txt", data: "ok" }]);
+    // Craft one entry using the prefix field by hand.
+    const block = header("tail.txt", "0", 2);
+    block.set(encoder.encode("owner-repo-abc123/some/dir"), 345);
+    const data = pad(encoder.encode("ok"));
+    const joined = new Uint8Array(bytes.length + block.length + data.length);
+    joined.set(block, 0);
+    joined.set(data, block.length);
+    joined.set(bytes, block.length + data.length);
+    const { paths } = await readTar(stream(joined), () => false);
+    assert.deepEqual(paths, ["some/dir/tail.txt", "plain.txt"]);
+});
+test("a truncated archive throws instead of returning half a repository", async () => {
+    const bytes = tarball([{ name: "owner-repo-abc123/a.txt", data: "hello" }]);
+    await assert.rejects(readTar(stream(bytes.subarray(0, 600)), () => true), TarError);
+});
+//# sourceMappingURL=tar.test.js.map

package/dist/board/tar.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.test.js","sourceRoot":"","sources":["../../src/board/tar.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAE5C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAUjC,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IACjC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;IACzE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/C,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC/B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7C,mDAAmD;IACnD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAA;IACxE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,OAAO,IAAI,CAAA;YACzC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAA;YAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAClB,EAAE,IAAI,KAAK,CAAC,MAAM,CAAA;IACpB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,GAAG,CAAC,IAAgB;IAC3B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;IACjE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAK,CAAC,WAAW,CACpD,IAAI,mBAAmB,CAAC,MAAM,CAAC,CACF,CAAA;AACjC,CAAC;AAED,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,KAAK,GAAG,OAAO,CAAC;QACpB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACnE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,EAAE;QACzC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,MAAM,EAAE;QACrD,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,uCAAuC,EAAE;QAC9F,EAAE,IAAI,EAAE,6CAA6C,EAAE,IAAI,EAAE,iCAAiC,EAAE;QAChG,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAClE,EAAE,IAAI,EAAE,yCAAyC,EAAE,IAAI,EAAE,IAAI,EAAE;KAChE,CAAC,CAAA;IACF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;QACtB,WAAW;QACX,mBAAmB;QACnB,2BAA2B;QAC3B,cAAc;QACd,uBAAuB;KACxB,CAAC,CAAA;IACF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE;QAClC,mBAAmB;QACnB,2BAA2B;QAC3B,uBAAuB;KACxB,CAAC,CAAA;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAA;AACnH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,QAAQ,GAAG,qBAAqB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAA;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC;QACpB,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;KAC/D,CAAC,CAAA;IACF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACtE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC7B,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC5E,kDAAkD;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACxC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IACxE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACpB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;IAC5D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,CAAA;AAC7D,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAC3E,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAA;AACrF,CAAC,CAAC,CAAA"}

package/dist/cli.js

@@ -60,6 +60,7 @@ const BOOLEAN_FLAGS = new Set([
     "fix",
     "next",
     "force",
+    "no-functions",
     "reopen",
     "lock-only",
     "dry-run",
@@ -1287,6 +1288,24 @@ function cmdExport(args) {
     // every asset copied.
     const out = str(args.flags, "out") ?? join(serveRoot, DEFAULT_OUT_DIR);
     const outDir = isAbsolute(out) ? out : resolve(process.cwd(), out);
+    // The live proxy is written unless told not to. It is inert until the host
+    // has a token — it answers 503 and the board reads the snapshot — so the
+    // default costs nothing, and turning a deploy live becomes one secret
+    // rather than a re-export. The repository it reads is baked in: the export
+    // already knows (the same remote detection `task publish` uses), and one
+    // fewer setting on the host is one fewer thing to get wrong.
+    let functions;
+    let noRemote = false;
+    if (!args.flags["no-functions"]) {
+        const slug = str(args.flags, "repo");
+        const ref = slug ? parseSlug(slug) : detectRepo(serveRoot);
+        if (slug && !ref)
+            fail(`--repo must be owner/name — got ${JSON.stringify(slug)}`);
+        if (ref)
+            functions = { repo: `${ref.owner}/${ref.repo}` };
+        else
+            noRemote = true;
+    }
     let summary;
     try {
         summary = writeExport({
@@ -1295,6 +1314,7 @@ function cmdExport(args) {
             uiDir: UI_DIR,
             force: Boolean(args.flags.force),
             base: str(args.flags, "base"),
+            functions,
         });
     }
     catch (error) {
@@ -1308,6 +1328,14 @@ function cmdExport(args) {
     console.log(`Exported ${what}${summary.commit ? ` at ${summary.commit.slice(0, 7)}` : ""}`);
     console.log(`  ${summary.outDir}`);
     console.log("Serve that directory from any static host — the board reads snapshot.json.");
+    if (summary.functions && functions) {
+        // One line, every run: this tier has no viewer auth, and the moment the
+        // function is written is the moment to say so. The README says the rest.
+        console.log(`  ${summary.functions} reads ${functions.repo} live once the host has a TASK_GITHUB_TOKEN secret — to anyone who can reach it (README: "Live data for an exported board")`);
+    }
+    else if (noRemote) {
+        console.log("  no live function written — no GitHub remote to read from; pass --repo owner/name to add one");
+    }
 }
 /**
  * `task publish` — the board, at a URL.
@@ -1584,7 +1612,7 @@ Usage
                                 fails instead). Serves every board at or below
                                 here — in a monorepo the header becomes a
                                 board switcher
-  task export [--out <dir>] [--base <path>] [--force]
+  task export [--out <dir>] [--base <path>] [--force] [--no-functions | --repo <owner/name>]
                                 write the board out as static files — the same
                                 UI plus a snapshot.json it reads instead of an
                                 API, so any static host serves it read-only
@@ -1596,7 +1624,14 @@ Usage
                                 domain root. Re-exporting refreshes an earlier
                                 export in place and leaves anything else in
                                 there alone; a non-empty directory that isn't
-                                one needs --force
+                                one needs --force. Also writes a Cloudflare
+                                Pages Function that reads the repo live from
+                                GitHub: inert until the host has a
+                                TASK_GITHUB_TOKEN secret (a fine-grained PAT,
+                                Contents: read-only), at which point the same
+                                deploy upgrades itself — no viewer auth, mind.
+                                The repo comes from your remotes; --repo sets
+                                it, --no-functions skips the function
   task publish [--public | --private] [--repo <owner/name>]
                                 give this repo's board a URL at
                                 task.nickmeriano.com, read-only, updated from