@steve31415/baselib 3.35.0 → 3.36.1

package/dist/deploy/deploy.js

@@ -15,6 +15,20 @@ import { acquireLock, clearHold, publishRetainedAssets, readHold, readReleaseRec
 import { consistentBaseSha, readServingState, SHA40 } from './plan.js';
 const RELEASE_DEADLINE_MS = 25 * 60_000;
 const IMAGE_DIGEST = /@sha256:[0-9a-f]{64}$/;
+const MAX_DIRTY_PATHS = 20;
+/** The clean-worktree refusal, naming what made the tree dirty (`git status
+ * --porcelain` lines) so the reader need not go and look (2026-10-11: games'
+ * deploy checkout held untracked Cloudflare-era build outputs). */
+function dirtyWorktreeMessage(porcelain) {
+    const lines = porcelain.split('\n').filter((l) => l.trim() !== '');
+    const shown = lines.slice(0, MAX_DIRTY_PATHS);
+    const more = lines.length - shown.length;
+    return [
+        'deploys require a clean worktree; uncommitted or untracked files:',
+        ...shown.map((l) => `  ${l}`),
+        ...(more > 0 ? [`  … and ${more} more`] : []),
+    ].join('\n');
+}
 export async function runDeploy(options) {
     const log = options.log ?? ((m) => console.error(`[pw-deploy] ${m}`));
     const runner = options.runner;
@@ -37,9 +51,9 @@ export async function runDeploy(options) {
             throw new Error('deploys run from main');
         const dirty = (await must(runner, 'git', ['status', '--porcelain=v1', '--untracked-files=all'], {
             cwd: options.repoRoot,
-        })).stdout.trim();
-        if (dirty)
-            throw new Error('deploys require a clean worktree');
+        })).stdout;
+        if (dirty.trim())
+            throw new Error(dirtyWorktreeMessage(dirty));
         const sha = (await must(runner, 'git', ['rev-parse', 'HEAD'], { cwd: options.repoRoot })).stdout.trim();
         const originMain = (await must(runner, 'git', ['rev-parse', 'origin/main'], { cwd: options.repoRoot })).stdout.trim();
         if (sha !== originMain)

package/dist/s2s.d.ts

@@ -7,8 +7,12 @@ import { type Logger } from './log-core.js';
  * disables the always-allow rule (fail closed). */
 export declare function codingAgentSa(): string | undefined;
 /** caller service-account email → allowed "METHOD /path" patterns.
- *  Patterns: exact ("GET /api/whoami"), trailing wildcard ("POST /api/admin/*"),
- *  or "*" for everything. */
+ *  Patterns: exact ("GET /api/whoami"), trailing wildcard ("POST /api/admin/*",
+ *  a prefix: the bare path and everything under it), a single-segment
+ *  wildcard anywhere else ("GET /api/tasks/*\/card": exactly one non-empty
+ *  segment in that position, so one task-scoped method can be granted without
+ *  the whole prefix — 2026-10-12, Radar's grant on Coder's card and decide
+ *  routes), or "*" for everything. */
 export type Grants = Record<string, string[]>;
 export interface ServiceCaller {
     type: 's2s';

package/dist/s2s.js

@@ -40,9 +40,20 @@ export function grantAllows(grants, email, method, path) {
             const prefix = p.slice(0, -1); // keep the trailing slash
             return want.startsWith(prefix) || want === p.slice(0, -2);
         }
+        if (p.includes('/*/'))
+            return segmentsMatch(p, want);
         return want === p;
     });
 }
+/** "METHOD /a/*\/b" against "METHOD /a/x/b": the same number of segments,
+ *  each equal or a `*` standing for exactly one non-empty segment. */
+function segmentsMatch(pattern, want) {
+    const ps = pattern.split('/');
+    const ws = want.split('/');
+    if (ps.length !== ws.length)
+        return false;
+    return ps.every((seg, i) => (seg === '*' ? ws[i].length > 0 : seg === ws[i]));
+}
 // Fixed-window per-identity rate limiter — a sanity check against runaway
 // loops and mischief, not a precision tool (per-instance state only).
 export class RateLimiter {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.35.0",
+  "version": "3.36.1",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",