@bevel-software/platform-core-backend 0.14.0 → 0.15.1

package/dist/modules/marketplace/github-facade/github-facade.service.d.ts

@@ -0,0 +1,109 @@
+import type { MintedExternalApiKey } from '../../tool-auth/external-api-key.interface.js';
+import { type McpAuthRequestState } from '../../mcp/oauth/oauth-state.js';
+import type { GitHubFacadeCredentialsService } from './github-facade-credentials.service.js';
+import type { GitHubFacadeCodeStore } from './github-facade-codes.store.js';
+/**
+ * The KIND stored on a connection key minted through the facade, and the
+ * plaintext prefix that kind is minted with. `gho_` is what a GitHub OAuth
+ * token looks like — the shape a consumer expecting a GitHub Enterprise host
+ * accepts; the key is otherwise an ordinary connection key — hashed at rest,
+ * revocable from the person's external-agent page, accepted by every surface
+ * a connection key is. The kind, not the label, is what tells such a key
+ * apart: a label is the person's to edit.
+ */
+export declare const GITHUB_LINK_KEY_KIND = "github-link";
+export declare const GITHUB_LINK_KEY_PREFIX = "gho_";
+/**
+ * A product that talks to this deployment as if it were a GitHub Enterprise
+ * Server. The facade itself is consumer-neutral — GitHub's OAuth pair and
+ * REST subset are the contract — and a consumer is the one thing that is not:
+ * where its callback lives (the only place a code may be sent), what the
+ * consent page calls it, and how the keys it holds are labelled for the
+ * person. Claude is the first; another product with a "connect your GitHub
+ * Enterprise" flow is one more entry, not one more module.
+ */
+export interface GitHubFacadeConsumer {
+    id: string;
+    /** What the consent page says is asking. */
+    name: string;
+    /** Hostnames a redirect_uri may point at. */
+    redirectHosts: readonly string[];
+    /** The label on the connection keys minted for this consumer. */
+    keyLabel: string;
+}
+/** claude.ai and Cowork: the consumer this facade was built against. */
+export declare const CLAUDE_CONSUMER: GitHubFacadeConsumer;
+export interface GitHubFacadeKeyMinter {
+    mint(userId: string, label: string, options?: {
+        kind?: string;
+    }): Promise<MintedExternalApiKey>;
+}
+export interface GitHubFacadeDeps {
+    credentials: GitHubFacadeCredentialsService;
+    codes: GitHubFacadeCodeStore;
+    keys: GitHubFacadeKeyMinter;
+    /** Who may connect through the facade. */
+    consumers: readonly GitHubFacadeConsumer[];
+    /** HMAC secret for the signed authorize state — the same one the MCP flow uses. */
+    stateSecret: string;
+    /** SPA base URL — where the browser is sent to sign in and approve. */
+    publicFrontendUrl: string;
+}
+export declare class GitHubFacadeRequestError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/**
+ * The "connect your GitHub Enterprise account" flow, as a consumer such as claude.ai drives it
+ * against a GitHub Enterprise host — with hexis standing where GitHub would.
+ *
+ *   1. The browser lands on `/login/oauth/authorize?client_id&redirect_uri&state`.
+ *      We check the client id is ours and the redirect goes to claude.ai,
+ *      pack the request into the SAME signed state the MCP authorization
+ *      flow uses, and send the browser to the SPA's `/connect` page — where a
+ *      hexis session (or a sign-in) attaches a person to the request.
+ *   2. Finish on that page comes back through the consent routes with the
+ *      state; {@link completeConsent} stores a one-time code bound to that
+ *      person and returns the callback URL carrying it.
+ *   3. Anthropic's backend posts the code with our client id and secret to
+ *      `/login/oauth/access_token`; {@link exchangeCode} turns it into a
+ *      connection key for that person — the token every later fetch carries.
+ *
+ * Nothing here is remembered in the process: credentials and codes are read
+ * from their stores on every step, so the replica that issued a code and the
+ * replica that exchanges it need not be the same one.
+ */
+export declare class GitHubFacade {
+    private readonly deps;
+    constructor(deps: GitHubFacadeDeps);
+    /** Where to send the browser for an authorize request, or a 4xx to answer with. */
+    authorizeRedirect(query: Record<string, unknown>): Promise<string>;
+    /** True when a verified state is one of ours (a GitHub-shaped link, not an MCP client). */
+    isFacadeRequest(st: McpAuthRequestState): boolean;
+    /** What the consent page should say is asking, for one of our states. */
+    clientNameFor(st: McpAuthRequestState): string;
+    /**
+     * The person approved on `/connect`: a one-time code for them, and the
+     * claude.ai callback to send the browser to. Supersedes any live code the
+     * same person already had for this client.
+     */
+    completeConsent(userId: string, st: McpAuthRequestState): Promise<{
+        redirectTo: string;
+    }>;
+    /**
+     * The token exchange. Client id and secret must be ours and the code live;
+     * every check runs BEFORE the code is spent, so a request that is wrong
+     * about something else (its redirect, say) can be corrected and retried.
+     * Spending is one conditional update in the store — the first exchange
+     * wins, on whichever replica, and only the winner mints.
+     */
+    exchangeCode(body: Record<string, unknown>): Promise<{
+        access_token: string;
+        token_type: 'bearer';
+        scope: '';
+    }>;
+    /** The consumer whose callback a redirect_uri is, or null — https only, host exactly. */
+    private consumerFor;
+}
+//# sourceMappingURL=github-facade.service.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade.service.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAC7F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAClD,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wEAAwE;AACxE,eAAO,MAAM,eAAe,EAAE,oBAK7B,CAAC;AAKF,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACjG;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,8BAA8B,CAAC;IAC5C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,0CAA0C;IAC1C,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAE/C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,gBAAgB;IAEnD,mFAAmF;IAC7E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAsBxE,2FAA2F;IAC3F,eAAe,CAAC,EAAE,EAAE,mBAAmB,GAAG,OAAO;IAIjD,yEAAyE;IACzE,aAAa,CAAC,EAAE,EAAE,mBAAmB,GAAG,MAAM;IAI9C;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB/F;;;;;;OAMG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC;QACrB,KAAK,EAAE,EAAE,CAAC;KACX,CAAC;IA6BF,yFAAyF;IACzF,OAAO,CAAC,WAAW;CAUpB"}

package/dist/modules/marketplace/github-facade/github-facade.service.js

@@ -0,0 +1,172 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { signAuthRequest } from '../../mcp/oauth/oauth-state.js';
+/**
+ * The KIND stored on a connection key minted through the facade, and the
+ * plaintext prefix that kind is minted with. `gho_` is what a GitHub OAuth
+ * token looks like — the shape a consumer expecting a GitHub Enterprise host
+ * accepts; the key is otherwise an ordinary connection key — hashed at rest,
+ * revocable from the person's external-agent page, accepted by every surface
+ * a connection key is. The kind, not the label, is what tells such a key
+ * apart: a label is the person's to edit.
+ */
+export const GITHUB_LINK_KEY_KIND = 'github-link';
+export const GITHUB_LINK_KEY_PREFIX = 'gho_';
+/** claude.ai and Cowork: the consumer this facade was built against. */
+export const CLAUDE_CONSUMER = {
+    id: 'claude',
+    name: 'Claude',
+    redirectHosts: ['claude.ai'],
+    keyLabel: 'Claude (claude.ai and Cowork)',
+};
+const CODE_TTL_MS = 10 * 60_000;
+const CODE_BYTES = 10;
+export class GitHubFacadeRequestError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'GitHubFacadeRequestError';
+    }
+}
+/**
+ * The "connect your GitHub Enterprise account" flow, as a consumer such as claude.ai drives it
+ * against a GitHub Enterprise host — with hexis standing where GitHub would.
+ *
+ *   1. The browser lands on `/login/oauth/authorize?client_id&redirect_uri&state`.
+ *      We check the client id is ours and the redirect goes to claude.ai,
+ *      pack the request into the SAME signed state the MCP authorization
+ *      flow uses, and send the browser to the SPA's `/connect` page — where a
+ *      hexis session (or a sign-in) attaches a person to the request.
+ *   2. Finish on that page comes back through the consent routes with the
+ *      state; {@link completeConsent} stores a one-time code bound to that
+ *      person and returns the callback URL carrying it.
+ *   3. Anthropic's backend posts the code with our client id and secret to
+ *      `/login/oauth/access_token`; {@link exchangeCode} turns it into a
+ *      connection key for that person — the token every later fetch carries.
+ *
+ * Nothing here is remembered in the process: credentials and codes are read
+ * from their stores on every step, so the replica that issued a code and the
+ * replica that exchanges it need not be the same one.
+ */
+export class GitHubFacade {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Where to send the browser for an authorize request, or a 4xx to answer with. */
+    async authorizeRedirect(query) {
+        const clientId = str(query.client_id);
+        const redirectUri = str(query.redirect_uri);
+        const state = str(query.state);
+        const creds = await this.deps.credentials.ensure();
+        if (!clientId || !safeEqual(clientId, creds.clientId)) {
+            throw new GitHubFacadeRequestError(400, 'unknown_client', 'Unknown client_id.');
+        }
+        if (!this.consumerFor(redirectUri)) {
+            throw new GitHubFacadeRequestError(400, 'invalid_redirect', 'redirect_uri does not belong to a known consumer.');
+        }
+        const signed = signAuthRequest(this.deps.stateSecret, {
+            c: clientId,
+            r: redirectUri,
+            s: state || undefined,
+            gh: true,
+        });
+        const url = new URL('/connect', this.deps.publicFrontendUrl);
+        url.searchParams.set('oauth', signed);
+        return url.toString();
+    }
+    /** True when a verified state is one of ours (a GitHub-shaped link, not an MCP client). */
+    isFacadeRequest(st) {
+        return st.gh === true;
+    }
+    /** What the consent page should say is asking, for one of our states. */
+    clientNameFor(st) {
+        return this.consumerFor(st.r)?.name ?? 'an external product';
+    }
+    /**
+     * The person approved on `/connect`: a one-time code for them, and the
+     * claude.ai callback to send the browser to. Supersedes any live code the
+     * same person already had for this client.
+     */
+    async completeConsent(userId, st) {
+        const creds = await this.deps.credentials.ensure();
+        if (!safeEqual(st.c, creds.clientId) || !this.consumerFor(st.r)) {
+            throw new GitHubFacadeRequestError(400, 'invalid_request', 'The authorization request is not one of ours.');
+        }
+        const code = randomBytes(CODE_BYTES).toString('hex');
+        await this.deps.codes.put({
+            codeHash: hashCode(code),
+            userId,
+            clientId: st.c,
+            redirectUri: st.r,
+            expiresAt: new Date(Date.now() + CODE_TTL_MS),
+        });
+        const url = new URL(st.r);
+        url.searchParams.set('code', code);
+        if (st.s)
+            url.searchParams.set('state', st.s);
+        return { redirectTo: url.toString() };
+    }
+    /**
+     * The token exchange. Client id and secret must be ours and the code live;
+     * every check runs BEFORE the code is spent, so a request that is wrong
+     * about something else (its redirect, say) can be corrected and retried.
+     * Spending is one conditional update in the store — the first exchange
+     * wins, on whichever replica, and only the winner mints.
+     */
+    async exchangeCode(body) {
+        const creds = await this.deps.credentials.ensure();
+        const clientId = str(body.client_id);
+        const clientSecret = str(body.client_secret);
+        const code = str(body.code);
+        if (!clientId || !clientSecret || !safeEqual(clientId, creds.clientId) || !safeEqual(clientSecret, creds.clientSecret)) {
+            throw new GitHubFacadeRequestError(401, 'incorrect_client_credentials', 'The client_id and/or client_secret passed are incorrect.');
+        }
+        const pending = code ? await this.deps.codes.peek(hashCode(code)) : null;
+        if (!pending || pending.clientId !== clientId) {
+            throw new GitHubFacadeRequestError(400, 'bad_verification_code', 'The code passed is incorrect or expired.');
+        }
+        const redirectUri = str(body.redirect_uri);
+        if (redirectUri && redirectUri !== pending.redirectUri) {
+            throw new GitHubFacadeRequestError(400, 'redirect_uri_mismatch', 'The redirect_uri does not match the authorization.');
+        }
+        const spent = await this.deps.codes.consume(pending.codeHash);
+        if (!spent) {
+            throw new GitHubFacadeRequestError(400, 'bad_verification_code', 'The code passed is incorrect or expired.');
+        }
+        // The consumer is the one the code was issued for — the redirect the
+        // person approved names it — so the key is labelled for that product.
+        const consumer = this.consumerFor(spent.redirectUri);
+        const minted = await this.deps.keys.mint(spent.userId, consumer?.keyLabel ?? 'GitHub-compatible link', {
+            kind: GITHUB_LINK_KEY_KIND,
+        });
+        return { access_token: minted.plaintext, token_type: 'bearer', scope: '' };
+    }
+    /** The consumer whose callback a redirect_uri is, or null — https only, host exactly. */
+    consumerFor(redirectUri) {
+        let parsed;
+        try {
+            parsed = new URL(redirectUri);
+        }
+        catch {
+            return null;
+        }
+        if (parsed.protocol !== 'https:')
+            return null;
+        return this.deps.consumers.find((c) => c.redirectHosts.includes(parsed.hostname)) ?? null;
+    }
+}
+function hashCode(code) {
+    return createHash('sha256').update(code).digest('hex');
+}
+function str(v) {
+    return typeof v === 'string' ? v : '';
+}
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+//# sourceMappingURL=github-facade.service.js.map

package/dist/modules/marketplace/github-facade/github-facade.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade.service.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAI3F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAqB7C,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,aAAa,EAAE,CAAC,WAAW,CAAC;IAC5B,QAAQ,EAAE,+BAA+B;CAC1C,CAAC;AAEF,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC;AAkBtB,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAEtC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEvD,mFAAmF;IACnF,KAAK,CAAC,iBAAiB,CAAC,KAA8B;QACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,EAAE,mDAAmD,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACpD,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,KAAK,IAAI,SAAS;YACrB,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,2FAA2F;IAC3F,eAAe,CAAC,EAAuB;QACrC,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;IACxB,CAAC;IAED,yEAAyE;IACzE,aAAa,CAAC,EAAuB;QACnC,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,qBAAqB,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,EAAuB;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;YACxB,MAAM;YACN,QAAQ,EAAE,EAAE,CAAC,CAAC;YACd,WAAW,EAAE,EAAE,CAAC,CAAC;YACjB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,IAA6B;QAK9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,8BAA8B,EAAE,0DAA0D,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,EAAE,0CAA0C,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,IAAI,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACvD,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,EAAE,oDAAoD,CAAC,CAAC;QACzH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,EAAE,0CAA0C,CAAC,CAAC;QAC/G,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI,wBAAwB,EAAE;YACrG,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;QACH,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,yFAAyF;IACjF,WAAW,CAAC,WAAmB;QACrC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5F,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/modules/marketplace/github-facade/index.d.ts

@@ -0,0 +1,6 @@
+export { GitHubFacadeCredentialsService, DbGitHubFacadeCredentialsStore, MemoryGitHubFacadeCredentialsStore, GitHubFacadeUnavailableError, type GitHubFacadeCredentials, type GitHubFacadeCredentialsStore, } from './github-facade-credentials.service.js';
+export { DbGitHubFacadeCodeStore, MemoryGitHubFacadeCodeStore, type GitHubFacadeCodeStore, type PendingFacadeCode, } from './github-facade-codes.store.js';
+export { GitHubFacade, GitHubFacadeRequestError, GITHUB_LINK_KEY_KIND, GITHUB_LINK_KEY_PREFIX, CLAUDE_CONSUMER, type GitHubFacadeConsumer, type GitHubFacadeDeps, } from './github-facade.service.js';
+export { createGitHubFacadeRoutes, type GitHubFacadeRoutesDeps } from './github-facade.routes.js';
+export { createGitHubFacadeAdminRoutes, type GitHubFacadeAdminRoutesDeps } from './github-facade-admin.routes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/marketplace/github-facade/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,4BAA4B,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,GAClC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAE,KAAK,2BAA2B,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/modules/marketplace/github-facade/index.js

@@ -0,0 +1,6 @@
+export { GitHubFacadeCredentialsService, DbGitHubFacadeCredentialsStore, MemoryGitHubFacadeCredentialsStore, GitHubFacadeUnavailableError, } from './github-facade-credentials.service.js';
+export { DbGitHubFacadeCodeStore, MemoryGitHubFacadeCodeStore, } from './github-facade-codes.store.js';
+export { GitHubFacade, GitHubFacadeRequestError, GITHUB_LINK_KEY_KIND, GITHUB_LINK_KEY_PREFIX, CLAUDE_CONSUMER, } from './github-facade.service.js';
+export { createGitHubFacadeRoutes } from './github-facade.routes.js';
+export { createGitHubFacadeAdminRoutes } from './github-facade-admin.routes.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/marketplace/github-facade/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,4BAA4B,GAG7B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAG5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAGhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAA+B,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAoC,MAAM,iCAAiC,CAAC"}

package/dist/modules/marketplace/index.d.ts

@@ -0,0 +1,4 @@
+export { MarketplaceRepoService, type MarketplaceCompiler, type EnsureResult } from './marketplace-repo.service.js';
+export { createMarketplaceGitRoutes, type MarketplaceKeyResolver } from './git-http.routes.js';
+export * from './github-facade/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/marketplace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/marketplace/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAE,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC/F,cAAc,0BAA0B,CAAC"}

package/dist/modules/marketplace/index.js

@@ -0,0 +1,4 @@
+export { MarketplaceRepoService } from './marketplace-repo.service.js';
+export { createMarketplaceGitRoutes } from './git-http.routes.js';
+export * from './github-facade/index.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/marketplace/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/marketplace/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA+C,MAAM,+BAA+B,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAA+B,MAAM,sBAAsB,CAAC;AAC/F,cAAc,0BAA0B,CAAC"}

package/dist/modules/marketplace/marketplace-repo.service.d.ts

@@ -0,0 +1,122 @@
+import { type ChildProcess } from 'node:child_process';
+import type { VirtualTree } from '../plugins/compile/compile-marketplace.js';
+/** What the repo service asks the compiler for — the one seam it has. */
+export interface MarketplaceCompiler {
+    sourceCommit(): Promise<string>;
+    compileFor(audience: {
+        userEmail: string;
+    }, 
+    /** The commit the tree is compiled from, when the caller already read it. */
+    sourceCommit?: string): Promise<VirtualTree & {
+        sourceCommit: string;
+    }>;
+}
+export interface EnsureResult {
+    /** The git namespace the caller's tree lives in. */
+    namespace: string;
+    /** True when a new commit was written this call. */
+    compiled: boolean;
+    sourceCommit: string;
+}
+/**
+ * ONE bare repository, ONE git namespace per caller.
+ *
+ * Every person's compiled marketplace is a branch in its own namespace
+ * (`refs/namespaces/<ns>/refs/heads/main`), which is exactly what git
+ * namespaces exist for (gitnamespaces(7)): `git http-backend` run with
+ * `GIT_NAMESPACE=<ns>` advertises only that namespace's refs, so a clone sees
+ * a repository whose `main` is their tree and nothing else — while every
+ * identical skill across callers is one blob in one object store.
+ *
+ * Freshness is LAZY and keyed on the knowledge base's default-branch commit:
+ * every input to a compile (skills, manifests, access rules, roles, groups)
+ * lives in that repository, so "same source commit" means "same answer".
+ * The last compiled source per namespace sits in a sidecar file rather than
+ * a commit trailer, so an unchanged tree costs no commit and no re-check.
+ *
+ * Each recompile appends a commit whose parent is the namespace's current
+ * head, so a client's `git pull` is always a fast-forward — including when
+ * access was withdrawn and files vanish. Writes go through git plumbing
+ * against a temporary index: no working tree of the bare repo, no checkout.
+ *
+ * Read-only by construction: `http.receivepack` is pinned off (http-backend
+ * would otherwise enable pushes for an authenticated REMOTE_USER), and the
+ * route refuses the receive-pack service before git ever sees it.
+ */
+export declare class MarketplaceRepoService {
+    /** Absolute path of the bare repository (created on first use). */
+    readonly repoDir: string;
+    private readonly compiler;
+    private readonly committer;
+    private readonly locks;
+    private initialised;
+    constructor(
+    /** Absolute path of the bare repository (created on first use). */
+    repoDir: string, compiler: MarketplaceCompiler, committer?: {
+        name: string;
+        email: string;
+    });
+    /** The directory `GIT_PROJECT_ROOT` points at, and the repo's name under it. */
+    get projectRoot(): string;
+    get repoName(): string;
+    /** The namespace for a user id — one path segment, stable, opaque. */
+    static namespaceFor(userId: string): string;
+    ensureRepo(): Promise<void>;
+    /**
+     * Bring the caller's namespace up to the knowledge base's current commit,
+     * compiling only when it moved. Serialised per namespace: two fetches
+     * arriving together compile once.
+     */
+    ensureCompiled(user: {
+        id: string;
+        email: string;
+    }): Promise<EnsureResult>;
+    /**
+     * The caller's namespace and its head commit, compiled if stale — what the
+     * GitHub-shaped REST surface (the Cowork path) reads instead of cloning.
+     */
+    headFor(user: {
+        id: string;
+        email: string;
+    }): Promise<{
+        namespace: string;
+        sha: string;
+    }>;
+    /** One commit as the REST surface describes it. */
+    describeCommit(sha: string): Promise<{
+        sha: string;
+        tree: string;
+        message: string;
+        authorName: string;
+        authorEmail: string;
+        date: string;
+    }>;
+    /**
+     * Whether `sha` is the namespace's head or one of its ancestors — the only
+     * commits a caller may read as that namespace. The object store is shared
+     * across everyone, so a sha alone is never enough.
+     */
+    contains(namespace: string, sha: string): Promise<boolean>;
+    /** The tree at `sha` as a zip stream, every path under `prefix/`. Check {@link contains} first. */
+    archiveZip(sha: string, prefix: string): ChildProcess;
+    private refOf;
+    private headOf;
+    /**
+     * Write `tree` as a commit on the namespace's branch. Materialises the
+     * virtual tree into a scratch directory, stages it into a throwaway index
+     * against the bare object store, and commits — no working tree involved.
+     * When the tree hash equals the head's, nothing is committed.
+     */
+    private commitTree;
+    /**
+     * Point the namespace's HEAD at its branch — valid before the branch
+     * exists. A read first: the symref is written only when absent or wrong,
+     * so the common path touches nothing.
+     */
+    private ensureHead;
+    private sidecarDir;
+    private readSidecar;
+    private writeSidecar;
+    private git;
+}
+//# sourceMappingURL=marketplace-repo.service.d.ts.map

package/dist/modules/marketplace/marketplace-repo.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace-repo.service.d.ts","sourceRoot":"","sources":["../../../src/modules/marketplace/marketplace-repo.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAI7E,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,UAAU,CACR,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE;IAC/B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,sBAAsB;IAK/B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,WAAW,CAA8B;;IAG/C,mEAAmE;IAC1D,OAAO,EAAE,MAAM,EACP,QAAQ,EAAE,mBAAmB,EAC7B,SAAS,GAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAGxD;IAGH,gFAAgF;IAChF,IAAI,WAAW,IAAI,MAAM,CAExB;IACD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,sEAAsE;IACtE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIrC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBjC;;;;OAIG;IACG,cAAc,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAqChF;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/F,mDAAmD;IAC7C,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IAcF;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBhE,mGAAmG;IACnG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY;IASrD,OAAO,CAAC,KAAK;YAIC,MAAM;IASpB;;;;;OAKG;YACW,UAAU;IAoDxB;;;;OAIG;YACW,UAAU;IAUxB,OAAO,CAAC,UAAU;YAIJ,WAAW;YAQX,YAAY;IAI1B,OAAO,CAAC,GAAG;CAGZ"}