canopycms 0.0.68-int.98 → 0.1.0

package/dist/validation/mdx-allowlist.js

@@ -0,0 +1,183 @@
+/**
+ * What an MDX body may hold, as `markdown-safety.ts` enforces it and as config validation and
+ * the editor read it. Dependency-free, so config schemas and the client bundle can import it
+ * without the MDX parser.
+ *
+ * An `MdxAllowlist` only narrows the base policy: a tag outside `SAFE_HTML_TAGS`, a name that is
+ * not a component, and a prop the base policy refuses are config errors, and every base rule
+ * still runs on what the allowlist accepts.
+ */
+/** HTML tags an MDX body may use: content elements whose attributes carry no code. */
+export const SAFE_HTML_TAGS = new Set([
+    'a',
+    'abbr',
+    'address',
+    'article',
+    'aside',
+    'audio',
+    'b',
+    'bdi',
+    'bdo',
+    'blockquote',
+    'br',
+    'caption',
+    'cite',
+    'code',
+    'col',
+    'colgroup',
+    'data',
+    'dd',
+    'del',
+    'details',
+    'dfn',
+    'div',
+    'dl',
+    'dt',
+    'em',
+    'figcaption',
+    'figure',
+    'footer',
+    'h1',
+    'h2',
+    'h3',
+    'h4',
+    'h5',
+    'h6',
+    'header',
+    'hgroup',
+    'hr',
+    'i',
+    'img',
+    'ins',
+    'kbd',
+    'li',
+    'main',
+    'mark',
+    'nav',
+    'ol',
+    'p',
+    'picture',
+    'pre',
+    'q',
+    'rp',
+    'rt',
+    'ruby',
+    's',
+    'samp',
+    'section',
+    'small',
+    'source',
+    'span',
+    'strong',
+    'sub',
+    'summary',
+    'sup',
+    'table',
+    'tbody',
+    'td',
+    'tfoot',
+    'th',
+    'thead',
+    'time',
+    'tr',
+    'track',
+    'u',
+    'ul',
+    'var',
+    'video',
+    'wbr',
+]);
+/**
+ * A JSX name MDX resolves from the site's components rather than rendering as an HTML tag. A name
+ * led by `_` or `$` could name one of MDX's own bindings, as could the two below.
+ */
+const COMPONENT_NAME = /^[A-Z][\w$]*$/;
+const MDX_BINDINGS = new Set(['MDXContent', 'MDXLayout']);
+export function isComponentName(name) {
+    return COMPONENT_NAME.test(name) && !MDX_BINDINGS.has(name);
+}
+/** Attribute names, lower-cased, that put markup or a document into the page. */
+export const FORBIDDEN_ATTRIBUTES = new Set([
+    'dangerouslysetinnerhtml',
+    'srcdoc',
+]);
+/**
+ * A component prop the base policy always refuses: an event handler by React's convention
+ * (`onClick`, while `online` stays a plain prop), or one in `FORBIDDEN_ATTRIBUTES`.
+ */
+export function isRefusedComponentProp(name) {
+    return /^on[A-Z]/.test(name) || FORBIDDEN_ATTRIBUTES.has(name.toLowerCase());
+}
+/**
+ * A string two allowlists share only if they accept the same MDX. Two spellings of one allowlist
+ * (value order, the full tag set listed out) can differ, which only ever refuses keeping content.
+ */
+export function allowlistIdentity(allow) {
+    const components = allow.components === undefined
+        ? null
+        : [...allow.components]
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([name, props]) => [
+            name,
+            props === undefined
+                ? null
+                : [...props].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),
+        ]);
+    const htmlTags = allow.htmlTags === SAFE_HTML_TAGS ? null : [...allow.htmlTags].sort();
+    return JSON.stringify([components, htmlTags, allow.expressions, allow.fragments]);
+}
+/** Each key the field sets replaces the site's; a key neither sets keeps the base policy. */
+export function resolveMdxAllowlist(field, site) {
+    const components = field?.components ?? site?.components;
+    const htmlTags = field?.htmlTags ?? site?.htmlTags;
+    return {
+        components: components === undefined
+            ? undefined
+            : new Map(Object.entries(components).map(([name, { props }]) => [
+                name,
+                props === undefined ? undefined : new Map(Object.entries(props)),
+            ])),
+        htmlTags: htmlTags === undefined ? SAFE_HTML_TAGS : new Set(htmlTags),
+        expressions: field?.expressions ?? site?.expressions ?? true,
+        fragments: field?.fragments ?? site?.fragments ?? true,
+    };
+}
+export function isMarkdownField(field) {
+    return field.type === 'markdown' || field.type === 'mdx';
+}
+/**
+ * The policy the server enforces and the editor follows, or undefined for an `executable` field. A
+ * field is MDX when typed `mdx` or set `renderAs: 'mdx'`. An entry's body (`bodyFormat` given, its
+ * field possibly undeclared) follows the entry instead: MDX in an `mdx` entry, and in an `md` entry
+ * only with `renderAs: 'mdx'`, since a site renders an `md` file as markdown.
+ */
+export function markdownPolicyOf(field, site, bodyFormat) {
+    if (field?.executable === true)
+        return undefined;
+    const mdx = bodyFormat === undefined
+        ? field?.type === 'mdx' || field?.renderAs === 'mdx'
+        : bodyFormat === 'mdx' || field?.renderAs === 'mdx';
+    return { dialect: mdx ? 'mdx' : 'md', allow: resolveMdxAllowlist(field?.mdxAllow, site) };
+}
+/**
+ * Why a markdown or mdx field's `renderAs`, `mdxAllow` and `executable` contradict each other, or
+ * undefined. An allowlist that cannot apply would look like protection it is not.
+ */
+export function markdownFieldOptionsError(field) {
+    const renderAs = field.renderAs;
+    if (renderAs !== undefined && renderAs !== 'mdx') {
+        return `Field "${field.name}": renderAs must be 'mdx'`;
+    }
+    if (renderAs !== undefined && field.type === 'mdx') {
+        return `Field "${field.name}": renderAs applies only to markdown fields`;
+    }
+    if (field.mdxAllow === undefined)
+        return undefined;
+    if (field.executable === true) {
+        return `Field "${field.name}": mdxAllow has no effect with executable: true, which turns the check off`;
+    }
+    if (field.type === 'markdown' && field.renderAs !== 'mdx') {
+        return `Field "${field.name}": mdxAllow applies to MDX; set renderAs: 'mdx' on a markdown field the site renders as MDX`;
+    }
+    return undefined;
+}

package/dist/validation/reference-validator.d.ts

@@ -5,6 +5,8 @@ export interface ValidationError {
     fieldPath: string;
     id: string;
     error: string;
+    /** A string id naming no entry (deleted, a collection, or malformed); set by `validate()`. */
+    dangling?: true;
 }
 export interface ValidationResult {
     valid: boolean;

package/dist/validation/reference-validator.js

@@ -54,6 +54,7 @@ export class ReferenceValidator {
                         fieldPath,
                         id: String(id),
                         error: 'Invalid content ID format',
+                        ...(typeof id === 'string' ? { dangling: true } : {}),
                     });
                     continue;
                 }
@@ -64,6 +65,7 @@ export class ReferenceValidator {
                         fieldPath,
                         id,
                         error: 'Referenced entry does not exist',
+                        dangling: true,
                     });
                     continue;
                 }
@@ -73,6 +75,7 @@ export class ReferenceValidator {
                         fieldPath,
                         id,
                         error: 'ID points to a collection, not an entry',
+                        dangling: true,
                     });
                     continue;
                 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CANOPYCMS_VERSION = "0.0.68-int.98";
+export declare const CANOPYCMS_VERSION = "0.1.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated by scripts/bump-version.mjs, its only writer. The package builds with plain
 // tsc (rootDir: src), so src/ cannot import ../package.json; version.test.ts keeps the two equal.
-export const CANOPYCMS_VERSION = '0.0.68-int.98';
+export const CANOPYCMS_VERSION = '0.1.0';

package/dist/worker/branch-policy.d.ts

@@ -0,0 +1,124 @@
+/**
+ * How long GitHub's default branch, once read, is taken to be still the default.
+ * @internal Exported for tests.
+ */
+export declare const DEFAULT_BRANCH_TTL_MS: number;
+/** The longest branch name the gateway takes, in characters. */
+export declare const MAX_BRANCH_NAME_LENGTH = 255;
+/**
+ * The longest pull request title the gateway sends, in UTF-16 code units.
+ * @internal Exported for tests.
+ */
+export declare const MAX_PULL_REQUEST_TITLE_LENGTH = 1024;
+/**
+ * The longest pull request body the gateway sends: GitHub's own limit.
+ * @internal Exported for tests.
+ */
+export declare const MAX_PULL_REQUEST_BODY_LENGTH = 65536;
+export type GatewayOperation = 'push' | 'delete' | 'pull-request';
+export type RefusalReason = 'invalid' | 'protected' | 'settings' | 'not-a-commit' | 'too-long';
+/**
+ * Something the gateway refuses to do for any caller. No CanopyCMS flow asks for it, so no retry
+ * can change the answer: the task runner fails such a task permanently, and a refusal never arms
+ * the credential re-read (`LocalGitHubGateway.credentialed`).
+ */
+export declare class GatewayRefusalError extends Error {
+    readonly operation: GatewayOperation;
+    readonly branch: string;
+    readonly reason: RefusalReason;
+    constructor(operation: GatewayOperation, branch: string, reason: RefusalReason, message: string);
+}
+/**
+ * Why `branch` is not a name the gateway takes, before git sees it, or null. Printable ASCII only,
+ * so no two names differ invisibly; no `"`, `%`, `{` or `}`, which reach URLs and log lines; no
+ * leading `-`; no leading `refs/`, `heads/`, `tags/` or `remotes/`, which git's ref lookup could
+ * read as some other ref than `refs/heads/<branch>`.
+ * `git check-ref-format --branch` runs after this (`assertPlainBranchName`).
+ */
+export declare function branchNameProblem(branch: string): string | null;
+/**
+ * Why `pattern` cannot be a `protectedBranches` entry, or null. An entry is a branch name in which
+ * `*` matches any run of characters, `/` included; nothing else is a wildcard. A character no
+ * branch name can hold is refused rather than left to match nothing, so a list never protects
+ * less than it seems to.
+ * @internal Exported for tests.
+ */
+export declare function protectedPatternProblem(pattern: string): string | null;
+/**
+ * Whether `name` matches `pattern`, where `*` matches any run of characters. Never a regex.
+ * @internal Exported for tests.
+ */
+export declare function matchesBranchPattern(pattern: string, name: string): boolean;
+/**
+ * The most `protectedBranches` entries a policy takes. The wire answer lists them plus the base
+ * branch (`describe()`), so its bound is one above this.
+ */
+export declare const MAX_PROTECTED_BRANCHES = 1024;
+export interface BranchPolicyOptions {
+    /** The configured base branch (`CANOPYCMS_BASE_BRANCH`); never one read from the workspace. */
+    baseBranch?: string;
+    /** Further protected names and `*` globs (`CANOPYCMS_PROTECTED_BRANCHES`). */
+    protectedBranches?: readonly string[];
+    /** Test seam: the clock {@link DEFAULT_BRANCH_TTL_MS} is measured on. */
+    now?: () => number;
+}
+/** Reads GitHub's default branch: null for a repository with none. */
+export type DefaultBranchReader = () => Promise<string | null>;
+/**
+ * The protected set and the settings rules.
+ *
+ * A branch is protected when it is the configured base branch, GitHub's default branch or a
+ * `protectedBranches` entry, compared case-sensitively as GitHub compares refs. An exact entry
+ * also matches a name that sanitizes to the same workspace directory; a glob never matches a
+ * settings branch, whose plain push the worker needs. GitHub's default is re-read once
+ * {@link DEFAULT_BRANCH_TTL_MS} has passed since the read that set it, so a change of default
+ * takes up to that long to reach the set. A failed read is never cached: the operation fails.
+ * Reads are not shared between concurrent callers, because a push reads inside a mirror session
+ * and an operation that joined it from outside one would wait on that session.
+ *
+ * Settings branches are pushed plainly or not at all: no lease, no deletion, no pull request.
+ * One is a name with the reserved prefix, the task runner's own test (`isSettingsBranch`): branch
+ * creation refuses the prefix, while a configured settings name without it could be a content
+ * branch's.
+ */
+export declare class BranchPolicy {
+    private readonly exact;
+    private readonly globs;
+    private readonly now;
+    private githubDefault;
+    constructor(options?: BranchPolicyOptions);
+    /** The protected set as it stands: configured names and globs, and GitHub's default as last read. */
+    describe(): {
+        configured: string[];
+        githubDefault: string | null;
+    };
+    /** Whether `branch` is protected; GitHub's default is read only when nothing else matches. */
+    isProtected(branch: string, readDefault: DefaultBranchReader): Promise<boolean>;
+    /** Refuse a push to a protected branch, or a leased push to a settings branch. */
+    assertPushAllowed(branch: string, lease: string | undefined, readDefault: DefaultBranchReader, refuse: (reason: 'protected' | 'settings') => Error): Promise<void>;
+    /** Refuse to delete a protected branch or a settings branch. */
+    assertDeleteAllowed(branch: string, readDefault: DefaultBranchReader): Promise<void>;
+    /**
+     * Refuse a pull request whose head is protected or a settings branch, or whose text is over its
+     * cap. The base is not restricted: a branch keeps the base it was created from after the
+     * adopter moves theirs, and a pull request merges nothing by itself.
+     */
+    assertPullRequestAllowed(request: {
+        head: string;
+        title?: string;
+        body?: string;
+    }, readDefault: DefaultBranchReader): Promise<void>;
+    private isSettings;
+    private matchesConfigured;
+    private githubDefaultBranch;
+    /**
+     * Read GitHub's default branch now and keep it. A read that started before the one already kept
+     * never replaces it.
+     */
+    recordGitHubDefault(readDefault: DefaultBranchReader): Promise<string | null>;
+}
+/** Refuse pull request text over its cap; `refusing` opens the message, `branch` names its head. */
+export declare function assertPullRequestText(refusing: string, branch: string, text: {
+    title?: string;
+    body?: string;
+}): void;

package/dist/worker/branch-policy.js

@@ -0,0 +1,243 @@
+/**
+ * The GitHub gateway's branch policy: what it never does to GitHub, whatever the worker asks. The
+ * task queue, remote.git and every branch's metadata are on the shared workspace, which the CMS
+ * Lambda can write, so nothing here takes a branch to protect from a request.
+ */
+import { RESERVED_SETTINGS_BRANCH_PREFIX, sanitizeBranchName } from '../paths/branch-name.js';
+/**
+ * How long GitHub's default branch, once read, is taken to be still the default.
+ * @internal Exported for tests.
+ */
+export const DEFAULT_BRANCH_TTL_MS = 10 * 60_000;
+/** The longest branch name the gateway takes, in characters. */
+export const MAX_BRANCH_NAME_LENGTH = 255;
+/**
+ * The longest pull request title the gateway sends, in UTF-16 code units.
+ * @internal Exported for tests.
+ */
+export const MAX_PULL_REQUEST_TITLE_LENGTH = 1024;
+/**
+ * The longest pull request body the gateway sends: GitHub's own limit.
+ * @internal Exported for tests.
+ */
+export const MAX_PULL_REQUEST_BODY_LENGTH = 65_536;
+/**
+ * Something the gateway refuses to do for any caller. No CanopyCMS flow asks for it, so no retry
+ * can change the answer: the task runner fails such a task permanently, and a refusal never arms
+ * the credential re-read (`LocalGitHubGateway.credentialed`).
+ */
+export class GatewayRefusalError extends Error {
+    constructor(operation, branch, reason, message) {
+        super(message);
+        this.operation = operation;
+        this.branch = branch;
+        this.reason = reason;
+        this.name = 'GatewayRefusalError';
+    }
+}
+const deleting = (branch) => `Refusing to delete ${JSON.stringify(branch)} on GitHub`;
+const openingFrom = (head) => `Refusing to open a pull request from ${JSON.stringify(head)}`;
+const PROTECTED_WHY = "it is protected (the base branch, GitHub's default branch, or a name protectedBranches " +
+    'lists), which the CanopyCMS worker never changes. Nothing in CanopyCMS queues this; find out ' +
+    'what wrote this task.';
+/**
+ * Why `branch` is not a name the gateway takes, before git sees it, or null. Printable ASCII only,
+ * so no two names differ invisibly; no `"`, `%`, `{` or `}`, which reach URLs and log lines; no
+ * leading `-`; no leading `refs/`, `heads/`, `tags/` or `remotes/`, which git's ref lookup could
+ * read as some other ref than `refs/heads/<branch>`.
+ * `git check-ref-format --branch` runs after this (`assertPlainBranchName`).
+ */
+export function branchNameProblem(branch) {
+    if (branch.length === 0 || branch.length > MAX_BRANCH_NAME_LENGTH) {
+        return `a branch name is 1 to ${MAX_BRANCH_NAME_LENGTH} characters`;
+    }
+    if (!/^[\x21-\x7e]+$/.test(branch))
+        return 'it is not printable ASCII';
+    if (/["%{}]/.test(branch))
+        return 'it contains ", %, { or }';
+    if (branch.startsWith('-'))
+        return "it starts with '-'";
+    if (/^(?:refs|heads|tags|remotes)\//i.test(branch)) {
+        return "it starts with 'refs/', 'heads/', 'tags/' or 'remotes/'";
+    }
+    return null;
+}
+/**
+ * Why `pattern` cannot be a `protectedBranches` entry, or null. An entry is a branch name in which
+ * `*` matches any run of characters, `/` included; nothing else is a wildcard. A character no
+ * branch name can hold is refused rather than left to match nothing, so a list never protects
+ * less than it seems to.
+ * @internal Exported for tests.
+ */
+export function protectedPatternProblem(pattern) {
+    const named = branchNameProblem(pattern.replace(/\*/g, 'x'));
+    if (named !== null)
+        return named;
+    if (/[~^:?[\\]/.test(pattern))
+        return 'only * is a wildcard, and ~ ^ : ? [ \\ are not in branch names';
+    if (pattern.includes('..') || pattern.includes('@{') || pattern.includes('//')) {
+        return "it contains '..', '@{' or '//'";
+    }
+    if (pattern.startsWith('/') || pattern.endsWith('/') || pattern.endsWith('.')) {
+        return "it starts or ends with '/', or ends with '.'";
+    }
+    if (pattern.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX)) {
+        return pattern.includes('*')
+            ? `a glob never matches a settings branch, so one starting ${RESERVED_SETTINGS_BRANCH_PREFIX} matches nothing`
+            : "a settings branch is pushed plainly every sync, so protecting it would stop this deployment's settings reaching GitHub";
+    }
+    return null;
+}
+/**
+ * Whether `name` matches `pattern`, where `*` matches any run of characters. Never a regex.
+ * @internal Exported for tests.
+ */
+export function matchesBranchPattern(pattern, name) {
+    const parts = pattern.split('*');
+    const first = parts[0];
+    const last = parts[parts.length - 1];
+    if (parts.length === 1)
+        return pattern === name;
+    if (name.length < first.length + last.length)
+        return false;
+    if (!name.startsWith(first) || !name.endsWith(last))
+        return false;
+    let at = first.length;
+    const end = name.length - last.length;
+    for (const part of parts.slice(1, -1)) {
+        const found = name.indexOf(part, at);
+        if (found === -1 || found + part.length > end)
+            return false;
+        at = found + part.length;
+    }
+    return true;
+}
+/**
+ * The most `protectedBranches` entries a policy takes. The wire answer lists them plus the base
+ * branch (`describe()`), so its bound is one above this.
+ */
+export const MAX_PROTECTED_BRANCHES = 1024;
+/**
+ * The protected set and the settings rules.
+ *
+ * A branch is protected when it is the configured base branch, GitHub's default branch or a
+ * `protectedBranches` entry, compared case-sensitively as GitHub compares refs. An exact entry
+ * also matches a name that sanitizes to the same workspace directory; a glob never matches a
+ * settings branch, whose plain push the worker needs. GitHub's default is re-read once
+ * {@link DEFAULT_BRANCH_TTL_MS} has passed since the read that set it, so a change of default
+ * takes up to that long to reach the set. A failed read is never cached: the operation fails.
+ * Reads are not shared between concurrent callers, because a push reads inside a mirror session
+ * and an operation that joined it from outside one would wait on that session.
+ *
+ * Settings branches are pushed plainly or not at all: no lease, no deletion, no pull request.
+ * One is a name with the reserved prefix, the task runner's own test (`isSettingsBranch`): branch
+ * creation refuses the prefix, while a configured settings name without it could be a content
+ * branch's.
+ */
+export class BranchPolicy {
+    constructor(options = {}) {
+        this.githubDefault = null;
+        this.now = options.now ?? (() => Date.now());
+        const entries = [...(options.protectedBranches ?? [])];
+        if (entries.length > MAX_PROTECTED_BRANCHES) {
+            throw new Error(`protectedBranches has ${entries.length} entries; the most it takes is ${MAX_PROTECTED_BRANCHES}`);
+        }
+        for (const entry of entries) {
+            const problem = protectedPatternProblem(entry);
+            if (problem !== null) {
+                throw new Error(`Invalid protectedBranches entry ${JSON.stringify(entry)}: ${problem}`);
+            }
+        }
+        if (options.baseBranch !== undefined)
+            entries.push(options.baseBranch);
+        this.exact = entries.filter((entry) => !entry.includes('*'));
+        this.globs = entries.filter((entry) => entry.includes('*'));
+    }
+    /** The protected set as it stands: configured names and globs, and GitHub's default as last read. */
+    describe() {
+        return {
+            configured: [...this.exact, ...this.globs],
+            githubDefault: this.githubDefault?.name ?? null,
+        };
+    }
+    /** Whether `branch` is protected; GitHub's default is read only when nothing else matches. */
+    async isProtected(branch, readDefault) {
+        if (this.matchesConfigured(branch))
+            return true;
+        const githubDefault = await this.githubDefaultBranch(readDefault);
+        return githubDefault !== null && sameBranch(githubDefault, branch);
+    }
+    /** Refuse a push to a protected branch, or a leased push to a settings branch. */
+    async assertPushAllowed(branch, lease, readDefault, refuse) {
+        if (await this.isProtected(branch, readDefault))
+            throw refuse('protected');
+        if (lease !== undefined && this.isSettings(branch))
+            throw refuse('settings');
+    }
+    /** Refuse to delete a protected branch or a settings branch. */
+    async assertDeleteAllowed(branch, readDefault) {
+        if (this.isSettings(branch)) {
+            throw new GatewayRefusalError('delete', branch, 'settings', `${deleting(branch)}: it is a settings branch, which is never deleted`);
+        }
+        if (await this.isProtected(branch, readDefault)) {
+            throw new GatewayRefusalError('delete', branch, 'protected', `${deleting(branch)}: ${PROTECTED_WHY}`);
+        }
+    }
+    /**
+     * Refuse a pull request whose head is protected or a settings branch, or whose text is over its
+     * cap. The base is not restricted: a branch keeps the base it was created from after the
+     * adopter moves theirs, and a pull request merges nothing by itself.
+     */
+    async assertPullRequestAllowed(request, readDefault) {
+        const { head } = request;
+        assertPullRequestText(openingFrom(head), head, request);
+        if (this.isSettings(head)) {
+            throw new GatewayRefusalError('pull-request', head, 'settings', `${openingFrom(head)}: it is a settings branch, which never gets one`);
+        }
+        if (await this.isProtected(head, readDefault)) {
+            throw new GatewayRefusalError('pull-request', head, 'protected', `${openingFrom(head)}: ${PROTECTED_WHY}`);
+        }
+    }
+    isSettings(branch) {
+        return branch.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX);
+    }
+    matchesConfigured(branch) {
+        return (this.exact.some((name) => sameBranch(name, branch)) ||
+            // A glob never takes in a settings branch, whose one allowed push (plain) the worker needs:
+            // `*-prod` would otherwise stop `canopycms-settings-prod` reaching GitHub.
+            (!this.isSettings(branch) && this.globs.some((glob) => matchesBranchPattern(glob, branch))));
+    }
+    async githubDefaultBranch(readDefault) {
+        const cached = this.githubDefault;
+        if (cached !== null && this.now() - cached.readAt < DEFAULT_BRANCH_TTL_MS)
+            return cached.name;
+        return this.recordGitHubDefault(readDefault);
+    }
+    /**
+     * Read GitHub's default branch now and keep it. A read that started before the one already kept
+     * never replaces it.
+     */
+    async recordGitHubDefault(readDefault) {
+        const readAt = this.now();
+        const name = await readDefault();
+        if (this.githubDefault === null || readAt >= this.githubDefault.readAt) {
+            this.githubDefault = { name, readAt };
+        }
+        return name;
+    }
+}
+/** Refuse pull request text over its cap; `refusing` opens the message, `branch` names its head. */
+export function assertPullRequestText(refusing, branch, text) {
+    const over = (text.title?.length ?? 0) > MAX_PULL_REQUEST_TITLE_LENGTH
+        ? `its title is longer than ${MAX_PULL_REQUEST_TITLE_LENGTH} characters`
+        : (text.body?.length ?? 0) > MAX_PULL_REQUEST_BODY_LENGTH
+            ? `its body is longer than ${MAX_PULL_REQUEST_BODY_LENGTH} characters`
+            : null;
+    if (over !== null) {
+        throw new GatewayRefusalError('pull-request', branch, 'too-long', `${refusing}: ${over}`);
+    }
+}
+/** Equal, or naming the same workspace directory. */
+function sameBranch(a, b) {
+    return a === b || sanitizeBranchName(a) === sanitizeBranchName(b);
+}