hammerkit 1.23.0 → 1.25.0

package/dist/remote/server-client.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printable = exports.ServerError = void 0;
+const discovery_1 = require("../server/discovery");
+const TIMEOUT_MS = 10000;
+const WRITE_TIMEOUT_MS = 30000;
+class ServerError extends Error {
+}
+exports.ServerError = ServerError;
+// Text from the server or the identity provider is shown to the user: no
+// control characters, so it can't rewrite the terminal.
+function printable(value) {
+    return String(value)
+        .replace(/\p{Cc}/gu, '?')
+        .slice(0, 300);
+}
+exports.printable = printable;
+async function getJson(url, token) {
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: token ? { authorization: `Bearer ${token}` } : {},
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new ServerError(`unable to reach ${url}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (response.status === 401) {
+        throw new ServerError(`${url} did not accept the token`);
+    }
+    if (!response.ok) {
+        throw new ServerError(`${url} answered ${response.status}`);
+    }
+    return response.json();
+}
+// What the server says it is. The issuer registered with `remote add` has to be
+// one it accepts, otherwise a login would send the user to an identity provider
+// the server does not trust.
+async function getDiscovery(server) {
+    const document = (await getJson(`${server.url}${discovery_1.DISCOVERY_PATH}`));
+    if (document?.name !== 'hammerkit' || !Array.isArray(document.issuers)) {
+        throw new ServerError(`${server.url} is not a hammerkit server`);
+    }
+    return document;
+}
+exports.getDiscovery = getDiscovery;
+async function getMe(server, token) {
+    return (await getJson(`${server.url}/v1/me`, token));
+}
+exports.getMe = getMe;
+// A call that changes something, or whose answer the caller tells apart by status.
+// Anything but 2xx is an error carrying what the server said about it.
+async function callServer(server, token, method, path, body) {
+    const url = `${server.url}${path}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(method === 'GET' ? TIMEOUT_MS : WRITE_TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new ServerError(`unable to reach ${url}: ${printable(e instanceof Error ? e.message : e)}`);
+    }
+    let answer;
+    try {
+        answer = await response.json();
+    }
+    catch {
+        answer = undefined;
+    }
+    if (response.status === 401) {
+        throw new ServerError(`${server.url} did not accept the token`);
+    }
+    if (!response.ok) {
+        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        throw new ServerError(`${server.url} answered ${response.status}${said}`);
+    }
+    return { status: response.status, body: answer };
+}
+exports.callServer = callServer;
+//# sourceMappingURL=server-client.js.map

package/dist/remote/source-manifest.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedSourcePath = exports.hashSource = exports.sourceManifestSchema = exports.DIGEST_PATTERN = exports.MAX_MANIFEST_BODY_BYTES = exports.MAX_SOURCE_BYTES = exports.MAX_SOURCE_FILE_BYTES = exports.MAX_SOURCE_FILES = void 0;
+const crypto_1 = require("crypto");
+const zod_1 = require("zod");
+const bundle_1 = require("./bundle");
+exports.MAX_SOURCE_FILES = 20000;
+exports.MAX_SOURCE_FILE_BYTES = 32 * 1024 * 1024;
+exports.MAX_SOURCE_BYTES = 1024 * 1024 * 1024;
+// a manifest is about 200 bytes per file
+exports.MAX_MANIFEST_BODY_BYTES = 8 * 1024 * 1024;
+exports.DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+const sourceFileSchema = zod_1.z
+    .object({
+    path: zod_1.z.string(),
+    sha256: zod_1.z.string().regex(exports.DIGEST_PATTERN, 'expected 64 lowercase hex digits'),
+    size: zod_1.z.number().int().min(0).max(exports.MAX_SOURCE_FILE_BYTES),
+    mode: zod_1.z.enum(['file', 'exec']).default('file'),
+})
+    .strict();
+exports.sourceManifestSchema = zod_1.z
+    .object({ files: zod_1.z.array(sourceFileSchema).min(1).max(exports.MAX_SOURCE_FILES) })
+    .strict()
+    .superRefine((manifest, ctx) => {
+    const seen = new Set();
+    let bytes = 0;
+    manifest.files.forEach((file, index) => {
+        if (!(0, bundle_1.isBundlePath)(file.path)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['files', index, 'path'],
+                message: `"${file.path}" is not a path inside the project`,
+            });
+        }
+        if (seen.has(file.path)) {
+            ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files', index, 'path'], message: `${file.path} twice` });
+        }
+        seen.add(file.path);
+        bytes += file.size;
+    });
+    if (bytes > exports.MAX_SOURCE_BYTES) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files'], message: `more than ${exports.MAX_SOURCE_BYTES} bytes` });
+    }
+});
+// The name of a tree: the sha-256 of the JSON `[[path, sha-256, mode], ...]` in
+// path order. The same files have the same name wherever it is computed, and the
+// size is not part of it because the content digest already decides it.
+function hashSource(manifest) {
+    const files = [...manifest.files]
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))
+        .map((file) => [file.path, file.sha256, file.mode]);
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(JSON.stringify(files)).digest('hex')}`;
+}
+exports.hashSource = hashSource;
+const DENIED_DIRECTORIES = ['.git', '.ssh', '.aws', '.gnupg', '.kube'];
+const DENIED_NAMES = [
+    /^\.env$/i,
+    /^\.env\.(?!example$|sample$|template$|dist$)/i,
+    /^\.(npmrc|netrc|pypirc|dockercfg|git-credentials)$/i,
+    /^id_(rsa|dsa|ecdsa|ed25519)$/i,
+    /\.(pem|p12|pfx)$/i,
+];
+// Files that hold credentials are not sent to a server even when a `src` pattern
+// reaches them: a secret belongs in a secret provider, and a glob such as `**`
+// must not be what decides that a key leaves the machine.
+function deniedSourcePath(path) {
+    const parts = path.split('/');
+    const directory = parts.slice(0, -1).find((part) => DENIED_DIRECTORIES.includes(part));
+    if (directory !== undefined) {
+        return `${directory}/ holds credentials or history`;
+    }
+    const name = parts[parts.length - 1];
+    if (DENIED_NAMES.some((pattern) => pattern.test(name))) {
+        return `${name} looks like a credential file`;
+    }
+    return null;
+}
+exports.deniedSourcePath = deniedSourcePath;
+//# sourceMappingURL=source-manifest.js.map

package/dist/remote/text-diff.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffBundles = exports.diffLines = exports.visible = void 0;
+// Text from a proposal is shown to somebody who decides on it, so nothing in it may
+// rewrite the terminal or hide what it says: control and format characters (which
+// include the ones that reorder text) are shown as `?`. Long lines are not cut,
+// what is hidden behind a cut is what a reviewer needs to see.
+function visible(line) {
+    return line.replace(/\t/g, '  ').replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
+}
+exports.visible = visible;
+// Beyond this many comparisons a file is shown whole instead of compared.
+const MAX_CELLS = 4000000;
+// The lines that differ, with `context` lines around each change.
+function diffLines(before, after, context = 2) {
+    if ((before.length + 1) * (after.length + 1) > MAX_CELLS) {
+        return undefined;
+    }
+    const n = before.length;
+    const m = after.length;
+    // lengths of the longest common suffixes
+    const table = Array.from({ length: n + 1 }, () => new Uint32Array(m + 1));
+    for (let i = n - 1; i >= 0; i--) {
+        for (let j = m - 1; j >= 0; j--) {
+            table[i][j] = before[i] === after[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+        }
+    }
+    const all = [];
+    let i = 0;
+    let j = 0;
+    while (i < n && j < m) {
+        if (before[i] === after[j]) {
+            all.push({ type: ' ', text: before[i] });
+            i++;
+            j++;
+        }
+        else if (table[i + 1][j] >= table[i][j + 1]) {
+            all.push({ type: '-', text: before[i++] });
+        }
+        else {
+            all.push({ type: '+', text: after[j++] });
+        }
+    }
+    while (i < n)
+        all.push({ type: '-', text: before[i++] });
+    while (j < m)
+        all.push({ type: '+', text: after[j++] });
+    const keep = new Array(all.length).fill(false);
+    all.forEach((line, index) => {
+        if (line.type !== ' ') {
+            for (let k = Math.max(0, index - context); k <= Math.min(all.length - 1, index + context); k++) {
+                keep[k] = true;
+            }
+        }
+    });
+    return all.filter((_, index) => keep[index]);
+}
+exports.diffLines = diffLines;
+const lines = (text) => (text === '' ? [] : text.replace(/\n$/, '').split('\n'));
+// What a proposal changes against the version it follows, file by file.
+function diffBundles(base, proposed) {
+    const out = [];
+    const before = base?.files ?? {};
+    const paths = [...new Set([...Object.keys(before), ...Object.keys(proposed.files)])].sort();
+    for (const path of paths) {
+        const old = before[path];
+        const next = proposed.files[path];
+        if (old === next) {
+            continue;
+        }
+        const status = old === undefined ? 'added' : next === undefined ? 'removed' : 'changed';
+        out.push(`--- ${visible(path)} (${status})`);
+        const compared = old !== undefined && next !== undefined ? diffLines(lines(old), lines(next)) : undefined;
+        if (compared) {
+            compared.forEach((line) => out.push(`${line.type} ${visible(line.text)}`));
+        }
+        else {
+            // added, removed or too large to compare: all of the old, then all of the new
+            lines(old ?? '').forEach((line) => out.push(`- ${visible(line)}`));
+            lines(next ?? '').forEach((line) => out.push(`+ ${visible(line)}`));
+        }
+    }
+    if (base && base.entry !== proposed.entry) {
+        out.unshift(`entry file: ${visible(base.entry)} -> ${visible(proposed.entry)}`);
+    }
+    return out;
+}
+exports.diffBundles = diffBundles;
+//# sourceMappingURL=text-diff.js.map

package/dist/schema/build-file-base-task-schema.js

@@ -11,6 +11,7 @@ const build_file_volume_schema_1 = require("./build-file-volume-schema");
 const duration_schema_1 = require("./duration-schema");
 const build_file_secret_schema_1 = require("./build-file-secret-schema");
 const resources_schema_1 = require("./resources-schema");
+const runner_schema_1 = require("./runner-schema");
 // what `extend` adds to (the rest, e.g. `image` or `shell`, the task just overrides)
 exports.RESET_PROPERTIES = ['deps', 'needs', 'src', 'generates', 'cmds', 'mounts', 'envs', 'labels'];
 exports.buildFileBaseTaskSchema = (0, zod_1.object)({
@@ -38,5 +39,8 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     account: (0, zod_1.string)().optional(),
     // CPU and memory limits of the container; a local task is not limited
     resources: resources_schema_1.resourcesSchema.optional(),
+    // Name of the server (see `hammerkit remote`) the task has to run on; defaults
+    // to the build file's `runner`. Never a local fallback when it is unknown.
+    runner: runner_schema_1.runnerSchema.optional(),
 });
 //# sourceMappingURL=build-file-base-task-schema.js.map

package/dist/schema/build-file-schema.js

@@ -10,6 +10,7 @@ const labels_schema_1 = require("./labels-schema");
 const cache_schema_1 = require("./cache-schema");
 const build_file_include_schema_1 = require("./build-file-include-schema");
 const build_file_secret_provider_schema_1 = require("./build-file-secret-provider-schema");
+const runner_schema_1 = require("./runner-schema");
 exports.buildFileSchema = (0, zod_1.object)({
     envs: envs_schema_1.envsSchema.optional(),
     tasks: (0, zod_1.record)(build_file_task_schema_1.buildFileTaskSchema).optional(),
@@ -21,6 +22,8 @@ exports.buildFileSchema = (0, zod_1.object)({
     secretProviders: build_file_secret_provider_schema_1.buildFileSecretProvidersSchema.optional(),
     secretAccounts: build_file_secret_provider_schema_1.buildFileSecretAccountsSchema.optional(),
     labels: labels_schema_1.labelsSchema.optional(),
+    // default `runner` of the tasks of this file
+    runner: runner_schema_1.runnerSchema.optional(),
 })
     .strict()
     .describe('Build file with support for containerization\nhttps://hammerkit.dev/docs/build-file');

package/dist/schema/reference-parser.js

@@ -26,8 +26,12 @@ async function parseReferences(ctx, mainScope, environment) {
         projectRoot: await (0, project_root_1.findProjectRoot)(mainScope.cwd, environment),
     };
     for (const file of Object.values(ctx.files)) {
+        if (environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
+            throw new Error(`${file.fileName} declares secret providers or accounts, which a server defines in its own config`);
+        }
         if (!reference.envFiles[file.cwd]) {
-            reference.envFiles[file.cwd] = await (0, read_env_file_1.readEnvFile)(file.cwd, environment);
+            // a server does not read the `.env` of a checkout: it is code of the project
+            reference.envFiles[file.cwd] = environment.hosted ? {} : await (0, read_env_file_1.readEnvFile)(file.cwd, environment);
         }
         const buildFileEnvs = file.schema.envs;
         if (file.schema.tasks) {
@@ -92,7 +96,9 @@ async function parseReferences(ctx, mainScope, environment) {
         resolveInit(reference, service);
     }
     reference.caches = (0, resolve_cache_1.withBuiltinCaches)(declaredCaches);
-    reference.secrets = (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
+    reference.secrets = environment.hosted
+        ? { ...environment.hosted.catalog, explicitAccounts: true }
+        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
     return reference;
 }
 exports.parseReferences = parseReferences;
@@ -121,6 +127,7 @@ function applySchemaExtension(reference, task) {
     task.schema.shell = task.schema.shell ?? extend.schema.shell;
     task.schema.cache = task.schema.cache ?? extend.schema.cache;
     task.schema.timeout = task.schema.timeout ?? extend.schema.timeout;
+    task.schema.runner = task.schema.runner ?? extend.schema.runner;
     if (!reset.has('cmds'))
         task.schema.cmds = extendArray(task.schema.cmds, extend.schema.cmds);
     if (!reset.has('src'))

package/dist/schema/runner-schema.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runnerSchema = void 0;
+const zod_1 = require("zod");
+const host_config_1 = require("../remote/host-config");
+// A server registered with `hammerkit remote add`; resolved on the machine that
+// runs the build, so the build file carries no URL.
+exports.runnerSchema = (0, zod_1.string)()
+    .min(1)
+    .refine((name) => !host_config_1.RESERVED_SERVER_NAMES.includes(name), {
+    message: 'local and auto are no servers, leave runner out to run where --on or the host config says',
+});
+//# sourceMappingURL=runner-schema.js.map

package/dist/secrets/provider-values.js

@@ -16,6 +16,10 @@ function keyOf(binding, ref) {
     return [binding.definition.name, binding.account.name, ref].join('\0');
 }
 function fetchProviderValue(binding, ref, environment) {
+    const allowed = environment.hosted?.accounts;
+    if (allowed && !allowed.includes(binding.account.name)) {
+        return Promise.reject(new Error(`the run may not read secrets as ${binding.account.name}`));
+    }
     let values = runs.get(environment);
     if (!values) {
         values = new Map();

package/dist/server/accounts-api.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleAccounts = void 0;
+const http_1 = require("./http");
+const policy_1 = require("./policy");
+/**
+ * Who the caller is and what they may do:
+ *
+ *   GET /v1/me         identity, accounts with their level, repositories and the builds level
+ *   GET /v1/accounts   the accounts the caller has a level on, with what the operator says about them
+ */
+async function handleAccounts(config, log, principal, req, res, url) {
+    if (url.pathname !== '/v1/me' && url.pathname !== '/v1/accounts') {
+        return false;
+    }
+    if (req.method !== 'GET') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+        return true;
+    }
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    const accounts = Object.entries(grant.accounts)
+        .sort(([a], [b]) => (a < b ? -1 : 1))
+        .map(([name, level]) => ({ name, level }));
+    if (url.pathname === '/v1/me') {
+        log(`grant iss=${principal.iss} sub=${principal.sub} accounts=[${accounts
+            .map((account) => `${account.name}:${account.level}`)
+            .join(',')}] entitlements=[${grant.matched.join(',')}]`);
+        (0, http_1.send)(res, 200, { iss: principal.iss, sub: principal.sub, accounts, repos: grant.repos, builds: grant.builds });
+        return true;
+    }
+    (0, http_1.send)(res, 200, {
+        accounts: accounts.map(({ name, level }) => ({
+            name,
+            ...(config.accounts[name]?.description ? { description: config.accounts[name].description } : {}),
+            level,
+            sources: config.accounts[name]?.source ?? ['upload', 'ref'],
+        })),
+    });
+    return true;
+}
+exports.handleAccounts = handleAccounts;
+//# sourceMappingURL=accounts-api.js.map

package/dist/server/approvals-api.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleApprovals = void 0;
+const zod_1 = require("zod");
+const http_1 = require("./http");
+const oauth_1 = require("./oauth");
+const policy_1 = require("./policy");
+const runs_1 = require("./runs");
+const decisionSchema = zod_1.z.object({ reason: zod_1.z.string().max(500).optional() }).strict();
+// What an approver is shown of a run: everything that decides whether to let it
+// go ahead, and who asked.
+function toApprovalView(run) {
+    return {
+        id: run.id,
+        state: run.state,
+        requestedBy: run.owner,
+        createdAt: run.createdAt,
+        definition: run.definition,
+        tasks: run.tasks,
+        accounts: run.accounts,
+        plan: run.plan,
+        source: run.source,
+        options: run.options,
+        approvals: run.approvals,
+    };
+}
+/**
+ * The runs waiting for an approval, which somebody who uses the accounts they
+ * need gives (one person is enough when they use all of them):
+ *
+ *   GET  /v1/approvals                  the runs the caller may approve
+ *   GET  /v1/approvals/<id>             one of them
+ *   POST /v1/approvals/<id>/approve     let it run (body: optional {reason})
+ *   POST /v1/approvals/<id>/reject      end it
+ *
+ * What the caller may not approve does not exist for them; their own run is the
+ * exception, they are told why it is not theirs to decide.
+ */
+async function handleApprovals(config, registry, log, principal, req, res, url) {
+    const match = /^\/v1\/approvals(?:\/([^/]+)(?:\/(approve|reject))?)?$/.exec(url.pathname);
+    if (!match) {
+        return false;
+    }
+    const [, id, action] = match;
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    const canDecide = (account) => (0, policy_1.canUse)(grant, account);
+    if (!id) {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        const open = registry
+            .waiting()
+            .filter((run) => !(run.owner.iss === principal.iss && run.owner.sub === principal.sub) &&
+            (run.approvals ?? []).some((approval) => !approval.approvedBy && canDecide(approval.account)));
+        (0, http_1.send)(res, 200, { approvals: open.map(toApprovalView) });
+        return true;
+    }
+    if (!runs_1.RUN_ID_PATTERN.test(id)) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (!action) {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        const run = registry.getForApproval(id, canDecide);
+        run ? (0, http_1.send)(res, 200, toApprovalView(run)) : (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (req.method !== 'POST') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        return true;
+    }
+    const body = decisionSchema.safeParse(req.headers['content-type'] ? await (0, http_1.readJson)(req) : {});
+    if (!body.success) {
+        const issue = body.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return true;
+    }
+    const outcome = action === 'approve' ? 'approved' : 'rejected';
+    const result = registry.decide(principal, id, outcome, canDecide, body.data.reason);
+    log(`${action} run=${id} iss=${principal.iss} sub=${principal.sub} result=${result.status}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
+    switch (result.status) {
+        case 'ok':
+            (0, http_1.send)(res, 200, toApprovalView(result.run));
+            break;
+        case 'own-run':
+            (0, http_1.send)(res, 403, { error: 'a run is approved by somebody else than who asked for it' });
+            break;
+        case 'not-waiting':
+            (0, http_1.send)(res, 409, { error: `the run is ${result.state}, it does not wait for an approval` });
+            break;
+        case 'already-approved':
+            (0, http_1.send)(res, 409, { error: 'you approved all you can, the run waits for somebody who uses the other accounts' });
+            break;
+        default:
+            (0, http_1.send)(res, 404, { error: 'not found' });
+    }
+    return true;
+}
+exports.handleApprovals = handleApprovals;
+//# sourceMappingURL=approvals-api.js.map

package/dist/server/definitions-api.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleDefinitions = void 0;
+const zod_1 = require("zod");
+const bundle_1 = require("../remote/bundle");
+const definitions_1 = require("./definitions");
+const http_1 = require("./http");
+const oauth_1 = require("./oauth");
+const policy_1 = require("./policy");
+const proposals_1 = require("./proposals");
+const server_config_1 = require("./server-config");
+// A bundle is JSON text with escapes, so the body may be somewhat larger than the files.
+const MAX_PUBLISH_BYTES = bundle_1.MAX_BUNDLE_BYTES * 2;
+/**
+ * The published build files:
+ *
+ *   PUT  /v1/definitions/<name>                 publish a bundle, or propose it when the
+ *                                               caller may only propose (answers 202)
+ *   GET  /v1/definitions                        the names, with their latest version
+ *   GET  /v1/definitions/<name>                 the versions of one
+ *   GET  /v1/definitions/<name>/<hash|latest>   one version
+ *   GET  /v1/definitions/<name>/<hash|latest>/files   the files of one version
+ *   POST /v1/definitions/<name>/<hash>/yank     pull a version back (body: optional {reason})
+ *   POST /v1/definitions/<name>/<hash>/unyank   let it go on
+ */
+async function handleDefinitions(config, store, proposals, log, principal, req, res, url) {
+    const match = /^\/v1\/definitions(?:\/([^/]+)(?:\/([^/]+)(\/files|\/yank|\/unyank)?)?)?$/.exec(url.pathname);
+    if (!match) {
+        return false;
+    }
+    const [, name, version, suffix] = match;
+    const files = suffix === '/files';
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    if (name !== undefined && !server_config_1.definitionName.safeParse(name).success) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (name !== undefined && version === undefined && req.method === 'PUT') {
+        await publish(config, store, proposals, log, principal, name, req, res);
+        return true;
+    }
+    if ((suffix === '/yank' || suffix === '/unyank') && req.method === 'POST') {
+        await yank(config, store, log, principal, name, version, suffix === '/unyank', req, res);
+        return true;
+    }
+    if (req.method !== 'GET') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, {
+            allow: suffix === '/yank' || suffix === '/unyank' ? 'POST' : name !== undefined && !version ? 'GET, PUT' : 'GET',
+        });
+        return true;
+    }
+    // what the caller may not see does not exist for them
+    if (!(0, policy_1.maySeeDefinitions)(grant)) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (name === undefined) {
+        (0, http_1.send)(res, 200, {
+            definitions: store.names().map((n) => ({ name: n, latest: store.find(n, 'latest')?.hash })),
+        });
+        return true;
+    }
+    if (version === undefined) {
+        const versions = store.list(name);
+        versions.length > 0
+            ? (0, http_1.send)(res, 200, { name, latest: versions[0].hash, versions })
+            : (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    const found = version === 'latest' || bundle_1.HASH_PATTERN.test(version) ? store.find(name, version) : undefined;
+    if (!found) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (files) {
+        const bundle = await store.files(found);
+        bundle ? (0, http_1.send)(res, 200, bundle) : (0, http_1.send)(res, 404, { error: 'not found' });
+    }
+    else {
+        (0, http_1.send)(res, 200, found);
+    }
+    return true;
+}
+exports.handleDefinitions = handleDefinitions;
+const yankSchema = zod_1.z.object({ reason: zod_1.z.string().max(500).optional() }).strict();
+// Yanking is allowed to who publishes the build file or uses an account the version
+// uses; letting a version go on again is the publisher's call.
+async function yank(config, store, log, principal, name, hash, undo, req, res) {
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    const version = bundle_1.HASH_PATTERN.test(hash) ? store.find(name, hash) : undefined;
+    if (!version || !(0, policy_1.maySeeDefinitions)(grant)) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return;
+    }
+    if (undo ? !(0, policy_1.mayPublish)(grant) : !(0, policy_1.mayYank)(grant, version)) {
+        log(`refuse ${undo ? 'unyank' : 'yank'} ${name}@${hash} iss=${principal.iss} sub=${principal.sub}`);
+        (0, http_1.send)(res, 403, {
+            error: undo
+                ? 'a version is let go on by who publishes the build file'
+                : 'a version is yanked by who publishes the build file or uses an account it uses',
+        });
+        return;
+    }
+    const body = yankSchema.safeParse(req.headers['content-type'] ? await (0, http_1.readJson)(req) : {});
+    if (!body.success) {
+        const issue = body.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return;
+    }
+    const changed = await store.yank(name, hash, principal, { reason: body.data.reason, undo });
+    log(`${undo ? 'unyank' : 'yank'} ${name}@${hash} iss=${principal.iss} sub=${principal.sub}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
+    (0, http_1.send)(res, 200, changed);
+}
+async function publish(config, store, proposals, log, principal, name, req, res) {
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    if (!(0, policy_1.mayPublish)(grant) && !(0, policy_1.mayPropose)(grant)) {
+        log(`refuse publish iss=${principal.iss} sub=${principal.sub}: no builds permission`);
+        (0, http_1.send)(res, 403, { error: `you may not publish ${name}, it needs builds: propose or publish` });
+        return;
+    }
+    const parsed = bundle_1.bundleSchema.safeParse(await (0, http_1.readJson)(req, MAX_PUBLISH_BYTES));
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return;
+    }
+    try {
+        // a version can't run before it is approved, but it has to load, as it would
+        // have when published, so the approver is not asked about a broken one
+        const { version, existing } = await store.prepare(name, parsed.data, principal, {
+            noRemote: !(0, policy_1.mayPublish)(grant),
+        });
+        if (existing) {
+            (0, http_1.send)(res, 200, { ...existing, created: false });
+            return;
+        }
+        // a version that names an account is published by somebody who uses it; anyone
+        // else proposes it, and somebody who does approves it (four eyes)
+        const missing = (version.accounts ?? []).filter((account) => !(0, policy_1.canUse)(grant, account));
+        if (!(0, policy_1.mayPublish)(grant) || missing.length > 0) {
+            const { proposal, created } = proposals.propose(version, parsed.data, principal, missing, store.find(name, 'latest')?.hash ?? null);
+            log(`propose ${name} ${proposal.hash} iss=${principal.iss} sub=${principal.sub} created=${created} tasks=${proposal.tasks.length} missing=[${missing.join(',')}]`);
+            (0, http_1.send)(res, created ? 202 : 200, { ...proposal, created });
+            return;
+        }
+        const { version: published, created } = await store.publish(name, parsed.data, principal);
+        log(`publish ${name} ${published.hash} iss=${principal.iss} sub=${principal.sub} created=${created} tasks=${published.tasks.length}`);
+        (0, http_1.send)(res, created ? 201 : 200, { ...published, created });
+    }
+    catch (e) {
+        if (e instanceof definitions_1.DefinitionError) {
+            log(`refuse publish iss=${principal.iss} sub=${principal.sub}: ${name} does not load`);
+            (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
+            return;
+        }
+        if (e instanceof proposals_1.ProposalError) {
+            (0, http_1.send)(res, e.status, { error: e.message });
+            return;
+        }
+        throw e;
+    }
+}
+//# sourceMappingURL=definitions-api.js.map