@bevel-software/platform-core-backend 0.14.0 → 0.15.1

package/dist/modules/kb-sync/sync-payload.js

@@ -0,0 +1,105 @@
+import { assertValidBranchName } from '../kb-fs/branch-name.js';
+const HEADS = 'refs/heads/';
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function branchFromRef(ref) {
+    if (typeof ref !== 'string' || !ref.startsWith(HEADS))
+        return null;
+    const name = ref.slice(HEADS.length);
+    return isValidBranch(name) ? name : null;
+}
+function isValidBranch(name) {
+    try {
+        assertValidBranchName(name);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function unique(names) {
+    return [...new Set(names)];
+}
+/**
+ * How an invalid explicit entry is echoed back. Only primitives are
+ * stringified: `String(obj)` on a JSON object carrying `"toString": 1` throws
+ * ("Cannot convert object to primitive value"), which would turn a caller's
+ * bad body into our 500.
+ */
+function describeInvalid(entry) {
+    if (entry === null)
+        return 'null';
+    switch (typeof entry) {
+        case 'string':
+            return entry.trim() === '' ? '(empty)' : entry;
+        case 'number':
+        case 'boolean':
+        case 'bigint':
+            return String(entry);
+        default:
+            return Array.isArray(entry) ? '(array)' : '(object)';
+    }
+}
+export function parseSyncPayload(body) {
+    if (!isRecord(body))
+        return { source: 'none', branches: 'all', invalid: [] };
+    if ('branches' in body) {
+        const raw = body.branches;
+        if (!Array.isArray(raw))
+            return { source: 'explicit', branches: 'all', invalid: [] };
+        const valid = [];
+        const invalid = [];
+        for (const entry of raw) {
+            if (typeof entry !== 'string' || !entry.trim()) {
+                invalid.push(describeInvalid(entry));
+                continue;
+            }
+            const name = entry.trim();
+            (isValidBranch(name) ? valid : invalid).push(name);
+        }
+        return { source: 'explicit', branches: unique(valid), invalid };
+    }
+    // Azure DevOps service hook. `eventType` names the event; the branches sit
+    // under `resource` in a per-event shape.
+    const eventType = body.eventType;
+    if (typeof eventType === 'string' && isRecord(body.resource)) {
+        const resource = body.resource;
+        if (eventType === 'git.push') {
+            const updates = Array.isArray(resource.refUpdates) ? resource.refUpdates : [];
+            // A DELETION (new object id all zeros) names its branch too: syncing it
+            // is what finds the branch gone and retires the stale clone, instead of
+            // leaving it to fail on some unrelated full sync later.
+            const branches = updates
+                .map((u) => (isRecord(u) ? branchFromRef(u.name) : null))
+                .filter((b) => b !== null);
+            return { source: 'azure-devops', branches: unique(branches), invalid: [] };
+        }
+        if (eventType.startsWith('git.pullrequest.')) {
+            const branches = [branchFromRef(resource.targetRefName), branchFromRef(resource.sourceRefName)]
+                .filter((b) => b !== null);
+            return { source: 'azure-devops', branches: unique(branches), invalid: [] };
+        }
+    }
+    // GitLab events all carry `object_kind`. Only a push (or a tag push, which
+    // names no branch) is a statement about a ref; anything else with a stray
+    // `ref` — a merge request, a pipeline — is not, and takes the "everything"
+    // fallback rather than being read as a push of that ref.
+    if (typeof body.object_kind === 'string') {
+        if (body.object_kind !== 'push' && body.object_kind !== 'tag_push') {
+            return { source: 'none', branches: 'all', invalid: [] };
+        }
+        // A deletion (a push to the null sha) names its branch like any push: the
+        // sync finds it gone and retires the clone.
+        const branch = branchFromRef(body.ref);
+        return { source: 'gitlab', branches: branch ? [branch] : [], invalid: [] };
+    }
+    // GitHub / Gitea push: `ref` at the top level, no `object_kind`. A deletion
+    // (`deleted: true`) names its branch like any push, for the same reason.
+    if (typeof body.ref === 'string') {
+        const branch = branchFromRef(body.ref);
+        return { source: 'github', branches: branch ? [branch] : [], invalid: [] };
+    }
+    return { source: 'none', branches: 'all', invalid: [] };
+}
+//# sourceMappingURL=sync-payload.js.map

package/dist/modules/kb-sync/sync-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-payload.js","sourceRoot":"","sources":["../../../src/modules/kb-sync/sync-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAkChE,MAAM,KAAK,GAAG,aAAa,CAAC;AAE5B,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACjD,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB;YACE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE7E,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IAED,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,wEAAwE;YACxE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,QAAQ,GAAG,OAAO;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACxD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;iBAC5F,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1D,CAAC"}

package/dist/modules/marketplace/git-http.routes.d.ts

@@ -0,0 +1,42 @@
+import express from 'express';
+import type { AuthUser } from '@bevel-software/platform-shared';
+import type { MarketplaceRepoService } from './marketplace-repo.service.js';
+import '../tool-auth/external-api-key.interface.js';
+/** How a bearer string resolves to a user — the connection-key service's shape. */
+export interface MarketplaceKeyResolver {
+    looksLikeExternalApiKey(token: string): boolean;
+    verifyAndLoadToken(plaintext: string): Promise<{
+        tokenId: string;
+        user: AuthUser;
+    } | null>;
+}
+/**
+ * The per-user marketplace as a git remote:
+ *
+ *   git clone https://key:<connection-key>@<host>/git/marketplace.git
+ *
+ * Anything that speaks git's smart HTTP protocol — Claude Code, Codex, `npx
+ * skills`, plain git — clones a repository whose `main` is the caller's
+ * compiled tree. The route authenticates, brings the caller's namespace up to
+ * date (`MarketplaceRepoService.ensureCompiled`), and hands the request to
+ * `git http-backend` with `GIT_NAMESPACE` set, so git itself serves the
+ * protocol and only that namespace's refs exist as far as the client can tell.
+ *
+ * AUTH: HTTP Basic with the connection key as the password (the username is
+ * anything — git sends whatever the URL carried), or the key as a Bearer
+ * token. The same keys the MCP endpoint takes, the same service resolving
+ * them, and the same metering stamp (`req.externalApiKeyId`), so a key's
+ * `lastUsedAt` moves when an agent refreshes its plugins. A 401 challenges
+ * with Basic so a client without credentials prompts for them.
+ *
+ * READ-ONLY: the receive-pack service is refused here by name, and the bare
+ * repository pins `http.receivepack=false` for good measure — a push would
+ * otherwise be enabled by http-backend the moment REMOTE_USER is set.
+ */
+export declare function createMarketplaceGitRoutes(deps: {
+    repo: MarketplaceRepoService;
+    keys: MarketplaceKeyResolver;
+    /** The URL path the router is mounted at, e.g. `/git`. Used for PATH_INFO. */
+    mountPath: string;
+}): express.Router;
+//# sourceMappingURL=git-http.routes.d.ts.map

package/dist/modules/marketplace/git-http.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-http.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/marketplace/git-http.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,4CAA4C,CAAC;AAEpD,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC5F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,IAAI,EAAE,sBAAsB,CAAC;IAC7B,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,CAwJjB"}

package/dist/modules/marketplace/git-http.routes.js

@@ -0,0 +1,190 @@
+import express from 'express';
+import { spawn } from 'node:child_process';
+import '../tool-auth/external-api-key.interface.js'; // Express Request augmentation (req.externalApiKeyId)
+/**
+ * The per-user marketplace as a git remote:
+ *
+ *   git clone https://key:<connection-key>@<host>/git/marketplace.git
+ *
+ * Anything that speaks git's smart HTTP protocol — Claude Code, Codex, `npx
+ * skills`, plain git — clones a repository whose `main` is the caller's
+ * compiled tree. The route authenticates, brings the caller's namespace up to
+ * date (`MarketplaceRepoService.ensureCompiled`), and hands the request to
+ * `git http-backend` with `GIT_NAMESPACE` set, so git itself serves the
+ * protocol and only that namespace's refs exist as far as the client can tell.
+ *
+ * AUTH: HTTP Basic with the connection key as the password (the username is
+ * anything — git sends whatever the URL carried), or the key as a Bearer
+ * token. The same keys the MCP endpoint takes, the same service resolving
+ * them, and the same metering stamp (`req.externalApiKeyId`), so a key's
+ * `lastUsedAt` moves when an agent refreshes its plugins. A 401 challenges
+ * with Basic so a client without credentials prompts for them.
+ *
+ * READ-ONLY: the receive-pack service is refused here by name, and the bare
+ * repository pins `http.receivepack=false` for good measure — a push would
+ * otherwise be enabled by http-backend the moment REMOTE_USER is set.
+ */
+export function createMarketplaceGitRoutes(deps) {
+    const { repo, keys, mountPath } = deps;
+    const router = express.Router();
+    const repoRoute = `/${repo.repoName}`;
+    const challenge = (res, message) => {
+        res.setHeader('WWW-Authenticate', 'Basic realm="hexis-marketplace"');
+        res.status(401).type('text/plain').send(message);
+    };
+    /** The connection key out of Basic (`user:key`, `key:` or `:key`) or Bearer. */
+    const keyOf = (header) => {
+        if (!header)
+            return null;
+        const space = header.indexOf(' ');
+        if (space < 0)
+            return null;
+        const scheme = header.slice(0, space).toLowerCase();
+        const value = header.slice(space + 1).trim();
+        if (scheme === 'bearer')
+            return value || null;
+        if (scheme !== 'basic')
+            return null;
+        let decoded;
+        try {
+            decoded = Buffer.from(value, 'base64').toString('utf-8');
+        }
+        catch {
+            return null;
+        }
+        const colon = decoded.indexOf(':');
+        const user = colon < 0 ? decoded : decoded.slice(0, colon);
+        const pass = colon < 0 ? '' : decoded.slice(colon + 1);
+        // Either half may carry the key: `https://key:<k>@` puts it in the
+        // password, `https://<k>@` in the username.
+        if (pass && keys.looksLikeExternalApiKey(pass))
+            return pass;
+        if (user && keys.looksLikeExternalApiKey(user))
+            return user;
+        return pass || user || null;
+    };
+    router.all(`${repoRoute}{/*rest}`, async (req, res) => {
+        const service = String(req.query.service ?? '');
+        const rest = `/${[].concat(req.params.rest ?? []).join('/')}`;
+        // Refuse writes before touching anything — by service name on info/refs,
+        // and by endpoint on the POST.
+        if (service === 'git-receive-pack' || rest === '/git-receive-pack') {
+            res.status(403).type('text/plain').send('This repository is read-only.');
+            return;
+        }
+        const key = keyOf(req.headers.authorization);
+        if (!key || !keys.looksLikeExternalApiKey(key)) {
+            challenge(res, 'A connection key is required: https://key:<connection-key>@<host>/git/marketplace.git');
+            return;
+        }
+        let resolved;
+        try {
+            resolved = await keys.verifyAndLoadToken(key);
+        }
+        catch (err) {
+            console.error('[marketplace] connection-key verification failed:', err);
+            res.status(500).type('text/plain').send('Authentication backend unavailable');
+            return;
+        }
+        if (!resolved) {
+            challenge(res, 'Invalid or revoked connection key');
+            return;
+        }
+        req.userId = resolved.user.id;
+        req.userEmail = resolved.user.email;
+        req.externalApiKeyId = resolved.tokenId;
+        let ensured;
+        try {
+            ensured = await repo.ensureCompiled({ id: resolved.user.id, email: resolved.user.email });
+        }
+        catch (err) {
+            console.error('[marketplace] compile failed:', err);
+            res.status(500).type('text/plain').send('Could not prepare your marketplace');
+            return;
+        }
+        // CGI, as git documents it. PATH_INFO is the path below GIT_PROJECT_ROOT
+        // — `/marketplace.git/info/refs` — regardless of where we are mounted.
+        const query = req.url.includes('?') ? req.url.slice(req.url.indexOf('?') + 1) : '';
+        const env = {
+            ...process.env,
+            GIT_PROJECT_ROOT: repo.projectRoot,
+            GIT_HTTP_EXPORT_ALL: '1',
+            GIT_NAMESPACE: ensured.namespace,
+            PATH_INFO: `${repoRoute}${rest}`,
+            REQUEST_METHOD: req.method,
+            QUERY_STRING: query,
+            CONTENT_TYPE: req.headers['content-type'] ?? '',
+            REMOTE_USER: resolved.user.email,
+            REMOTE_ADDR: req.ip ?? '',
+            SERVER_PROTOCOL: 'HTTP/1.1',
+            HTTP_HOST: req.headers.host ?? '',
+            SCRIPT_NAME: mountPath,
+        };
+        if (req.headers['content-length'])
+            env.CONTENT_LENGTH = String(req.headers['content-length']);
+        if (req.headers['content-encoding'])
+            env.HTTP_CONTENT_ENCODING = String(req.headers['content-encoding']);
+        if (req.headers['git-protocol'])
+            env.HTTP_GIT_PROTOCOL = String(req.headers['git-protocol']);
+        const child = spawn('git', ['http-backend'], { env, stdio: ['pipe', 'pipe', 'pipe'] });
+        child.stderr.on('data', (chunk) => console.warn(`[marketplace] http-backend: ${chunk.toString('utf-8').trim()}`));
+        child.on('error', (err) => {
+            console.error('[marketplace] could not run git http-backend:', err);
+            if (!res.headersSent)
+                res.status(500).type('text/plain').send('git is unavailable');
+        });
+        req.pipe(child.stdin);
+        req.on('aborted', () => child.kill());
+        // Parse the CGI header block (`Status:`, `Content-Type:`, …) off stdout,
+        // then stream the body straight through.
+        let headerBuf = Buffer.alloc(0);
+        let headersDone = false;
+        // Backpressure: a slow client must not make Node buffer a whole pack. One
+        // path for every body write, the remainder of the header chunk included.
+        const writeBody = (bytes) => {
+            if (!res.write(bytes)) {
+                child.stdout.pause();
+                res.once('drain', () => child.stdout.resume());
+            }
+        };
+        child.stdout.on('data', (chunk) => {
+            if (headersDone) {
+                writeBody(chunk);
+                return;
+            }
+            headerBuf = Buffer.concat([headerBuf, chunk]);
+            const cut = headerBuf.indexOf('\r\n\r\n') >= 0 ? headerBuf.indexOf('\r\n\r\n') : headerBuf.indexOf('\n\n');
+            if (cut < 0)
+                return;
+            const sepLen = headerBuf.indexOf('\r\n\r\n') >= 0 ? 4 : 2;
+            const head = headerBuf.subarray(0, cut).toString('utf-8');
+            let status = 200;
+            for (const line of head.split(/\r?\n/)) {
+                const colon = line.indexOf(':');
+                if (colon < 0)
+                    continue;
+                const name = line.slice(0, colon).trim();
+                const value = line.slice(colon + 1).trim();
+                if (name.toLowerCase() === 'status')
+                    status = Number.parseInt(value, 10) || 200;
+                else
+                    res.setHeader(name, value);
+            }
+            res.status(status);
+            headersDone = true;
+            const body = headerBuf.subarray(cut + sepLen);
+            if (body.length > 0)
+                writeBody(body);
+        });
+        child.stdout.on('end', () => {
+            if (!headersDone) {
+                if (!res.headersSent)
+                    res.status(502).type('text/plain').send('git http-backend produced no response');
+                return;
+            }
+            res.end();
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=git-http.routes.js.map

package/dist/modules/marketplace/git-http.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-http.routes.js","sourceRoot":"","sources":["../../../src/modules/marketplace/git-http.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,4CAA4C,CAAC,CAAC,sDAAsD;AAQ3G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEtC,MAAM,SAAS,GAAG,CAAC,GAAqB,EAAE,OAAe,EAAE,EAAE;QAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,gFAAgF;IAChF,MAAM,KAAK,GAAG,CAAC,MAA0B,EAAiB,EAAE;QAC1D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,IAAI,IAAI,CAAC;QAC9C,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACvD,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,IAAI,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;IAC9B,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAK,EAAe,CAAC,MAAM,CAAE,GAAG,CAAC,MAAuC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9G,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,OAAO,KAAK,kBAAkB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,EAAE,uFAAuF,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,IAAI,QAAoD,CAAC;QACzD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;QAExC,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,GAAG,GAAsB;YAC7B,GAAG,OAAO,CAAC,GAAG;YACd,gBAAgB,EAAE,IAAI,CAAC,WAAW;YAClC,mBAAmB,EAAE,GAAG;YACxB,aAAa,EAAE,OAAO,CAAC,SAAS;YAChC,SAAS,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE;YAChC,cAAc,EAAE,GAAG,CAAC,MAAM;YAC1B,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE;YAC/C,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAChC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;YACzB,eAAe,EAAE,UAAU;YAC3B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;YACjC,WAAW,EAAE,SAAS;SACvB,CAAC;QACF,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC9F,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAAE,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACzG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAE7F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1H,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtC,yEAAyE;QACzE,yCAAyC;QACzC,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,WAAW,EAAE,CAAC;gBAChB,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3G,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,MAAM,GAAG,GAAG,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,KAAK,GAAG,CAAC;oBAAE,SAAS;gBACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ;oBAAE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;;oBAC3E,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnB,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.d.ts

@@ -0,0 +1,23 @@
+import express from 'express';
+import '../../auth/auth.middleware.js';
+import { type GitHubFacadeCredentialsService } from './github-facade-credentials.service.js';
+export interface GitHubFacadeAdminRoutesDeps {
+    credentials: GitHubFacadeCredentialsService;
+    isAdmin(email: string | undefined): Promise<boolean>;
+    /** The deployment's public address; only its host is shown. */
+    publicUrl: string;
+    /** The marketplace URL people paste — the same one Claude Code clones. */
+    marketplaceUrl: string;
+}
+/**
+ * What an Owner needs to register this deployment in Claude's admin settings
+ * as a GitHub Enterprise Server, in the fields that form has — and the one
+ * verb on it, rotate. Admins only: the client secret is what makes claude.ai
+ * trust the token exchange. Never cached: after a rotation or a sign-out no
+ * copy of the old secrets may linger in a browser or a proxy.
+ *
+ *   GET  /api/admin/github-facade          the credentials and the two URLs
+ *   POST /api/admin/github-facade/rotate   new credentials, all of them
+ */
+export declare function createGitHubFacadeAdminRoutes(deps: GitHubFacadeAdminRoutesDeps): express.Router;
+//# sourceMappingURL=github-facade-admin.routes.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-admin.routes.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-admin.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,+BAA+B,CAAC;AACvC,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,8BAA8B,CAAC;IAC5C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAmD/F"}

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.js

@@ -0,0 +1,59 @@
+import express from 'express';
+import '../../auth/auth.middleware.js'; // Express Request.userId / userEmail augmentation
+import { GitHubFacadeUnavailableError, } from './github-facade-credentials.service.js';
+/**
+ * What an Owner needs to register this deployment in Claude's admin settings
+ * as a GitHub Enterprise Server, in the fields that form has — and the one
+ * verb on it, rotate. Admins only: the client secret is what makes claude.ai
+ * trust the token exchange. Never cached: after a rotation or a sign-out no
+ * copy of the old secrets may linger in a browser or a proxy.
+ *
+ *   GET  /api/admin/github-facade          the credentials and the two URLs
+ *   POST /api/admin/github-facade/rotate   new credentials, all of them
+ */
+export function createGitHubFacadeAdminRoutes(deps) {
+    const router = express.Router();
+    const requireAdmin = async (req, res, next) => {
+        if (!(await deps.isAdmin(req.userEmail))) {
+            res.status(403).json({ error: 'Admins only' });
+            return;
+        }
+        next();
+    };
+    const describe = async () => {
+        const creds = await deps.credentials.ensure();
+        return {
+            host: new URL(deps.publicUrl).host,
+            appId: creds.appId,
+            clientId: creds.clientId,
+            clientSecret: creds.clientSecret,
+            webhookSecret: creds.webhookSecret,
+            privateKeyPem: creds.privateKeyPem,
+            marketplaceUrl: deps.marketplaceUrl,
+            createdAt: creds.createdAt.getTime(),
+            rotatedAt: creds.rotatedAt ? creds.rotatedAt.getTime() : null,
+        };
+    };
+    const send = async (res, body) => {
+        try {
+            const payload = await body();
+            res.setHeader('Cache-Control', 'no-store');
+            res.json(payload);
+        }
+        catch (err) {
+            if (err instanceof GitHubFacadeUnavailableError) {
+                res.status(409).json({ error: err.message });
+                return;
+            }
+            console.error('[github-facade admin]', err);
+            res.status(500).json({ error: 'Internal error' });
+        }
+    };
+    router.get('/admin/github-facade', requireAdmin, (_req, res) => send(res, describe));
+    router.post('/admin/github-facade/rotate', requireAdmin, (_req, res) => send(res, async () => {
+        await deps.credentials.rotate();
+        return describe();
+    }));
+    return router;
+}
+//# sourceMappingURL=github-facade-admin.routes.js.map

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-admin.routes.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-admin.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,+BAA+B,CAAC,CAAC,kDAAkD;AAC1F,OAAO,EACL,4BAA4B,GAE7B,MAAM,wCAAwC,CAAC;AAWhD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAiC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;SAC9D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,GAAqB,EAAE,IAA4B,EAAE,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAA4B,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAErF,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACrE,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/marketplace/github-facade/github-facade-codes.store.d.ts

@@ -0,0 +1,59 @@
+import type { Database } from '../../database/connection.js';
+/**
+ * A one-time code the consent page issued, waiting for Anthropic's backend
+ * to exchange it. Looked up by the code's hash; the plaintext travels once,
+ * in the redirect.
+ */
+export interface PendingFacadeCode {
+    codeHash: string;
+    userId: string;
+    clientId: string;
+    redirectUri: string;
+    expiresAt: Date;
+}
+/**
+ * Where pending codes live. The database in production, so the consent
+ * finish on one replica and the exchange on another see the same row.
+ *
+ * The rule "one live code per person" is the TABLE'S: the person is its
+ * primary key, so issuing is an upsert — the newest code overwrites the last
+ * in one statement, two finishes racing each other cannot both leave a row
+ * behind, and the table holds at most one row per user, which goes when the
+ * user does. That is the whole bound; nothing here ever sweeps, and no
+ * rotation of the client id can strand a row, because the client id is data
+ * the exchange checks rather than part of the key. Spending is one
+ * conditional update: the first exchange wins, on whichever replica, and
+ * every later attempt finds the code spent. Nothing in memory takes part in
+ * either guarantee.
+ */
+export interface GitHubFacadeCodeStore {
+    /** Store a fresh code, replacing whatever the same person had. */
+    put(code: PendingFacadeCode): Promise<void>;
+    /** The live (unspent, unexpired) code with this hash, without spending it. */
+    peek(codeHash: string): Promise<PendingFacadeCode | null>;
+    /** Spend the code if it is live; null when it was not (unknown, spent, expired). */
+    consume(codeHash: string): Promise<PendingFacadeCode | null>;
+}
+export declare class DbGitHubFacadeCodeStore implements GitHubFacadeCodeStore {
+    private readonly db;
+    constructor(db: Database);
+    put(code: PendingFacadeCode): Promise<void>;
+    peek(codeHash: string): Promise<PendingFacadeCode | null>;
+    consume(codeHash: string): Promise<PendingFacadeCode | null>;
+}
+/**
+ * For tests: the same rules over a map keyed the way the table is. Share one
+ * instance to model shared storage. Check-and-mark is synchronous, as the
+ * database's conditional update is atomic: two exchanges of one code cannot
+ * both win here either.
+ */
+export declare class MemoryGitHubFacadeCodeStore implements GitHubFacadeCodeStore {
+    private readonly rows;
+    put(code: PendingFacadeCode): Promise<void>;
+    peek(codeHash: string): Promise<PendingFacadeCode | null>;
+    consume(codeHash: string): Promise<PendingFacadeCode | null>;
+    /** How many rows the store holds — at most one per person. */
+    get size(): number;
+    private findLive;
+}
+//# sourceMappingURL=github-facade-codes.store.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade-codes.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-codes.store.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-codes.store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAG7D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC1D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,qBAAa,uBAAwB,YAAW,qBAAqB;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAEnC,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAe3C,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASzD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAQnE;AAqBD;;;;;GAKG;AACH,qBAAa,2BAA4B,YAAW,qBAAqB;IACvE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsE;IAErF,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAKzD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAOlE,8DAA8D;IAC9D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,QAAQ;CAOjB"}

package/dist/modules/marketplace/github-facade/github-facade-codes.store.js

@@ -0,0 +1,96 @@
+import { and, eq, gt, isNull } from 'drizzle-orm';
+import { githubFacadeCodes } from '../../database/schema.js';
+export class DbGitHubFacadeCodeStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async put(code) {
+        const fresh = {
+            clientId: code.clientId,
+            codeHash: code.codeHash,
+            redirectUri: code.redirectUri,
+            expiresAt: code.expiresAt,
+            consumedAt: null,
+            createdAt: new Date(),
+        };
+        await this.db
+            .insert(githubFacadeCodes)
+            .values({ userId: code.userId, ...fresh })
+            .onConflictDoUpdate({ target: githubFacadeCodes.userId, set: fresh });
+    }
+    async peek(codeHash) {
+        const [row] = await this.db
+            .select()
+            .from(githubFacadeCodes)
+            .where(live(codeHash))
+            .limit(1);
+        return row ? toPending(row) : null;
+    }
+    async consume(codeHash) {
+        const [row] = await this.db
+            .update(githubFacadeCodes)
+            .set({ consumedAt: new Date() })
+            .where(live(codeHash))
+            .returning();
+        return row ? toPending(row) : null;
+    }
+}
+/** The one definition of "live": this hash, unspent, unexpired. */
+function live(codeHash) {
+    return and(eq(githubFacadeCodes.codeHash, codeHash), isNull(githubFacadeCodes.consumedAt), gt(githubFacadeCodes.expiresAt, new Date()));
+}
+function toPending(row) {
+    return {
+        codeHash: row.codeHash,
+        userId: row.userId,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        expiresAt: row.expiresAt,
+    };
+}
+/**
+ * For tests: the same rules over a map keyed the way the table is. Share one
+ * instance to model shared storage. Check-and-mark is synchronous, as the
+ * database's conditional update is atomic: two exchanges of one code cannot
+ * both win here either.
+ */
+export class MemoryGitHubFacadeCodeStore {
+    rows = new Map();
+    async put(code) {
+        this.rows.set(code.userId, { ...code, consumedAt: null });
+    }
+    async peek(codeHash) {
+        const row = this.findLive(codeHash);
+        return row ? strip(row) : null;
+    }
+    async consume(codeHash) {
+        const row = this.findLive(codeHash);
+        if (!row)
+            return null;
+        row.consumedAt = new Date();
+        return strip(row);
+    }
+    /** How many rows the store holds — at most one per person. */
+    get size() {
+        return this.rows.size;
+    }
+    findLive(codeHash) {
+        const now = Date.now();
+        for (const row of this.rows.values()) {
+            if (row.codeHash === codeHash && row.consumedAt === null && row.expiresAt.getTime() > now)
+                return row;
+        }
+        return null;
+    }
+}
+function strip(row) {
+    return {
+        codeHash: row.codeHash,
+        userId: row.userId,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        expiresAt: row.expiresAt,
+    };
+}
+//# sourceMappingURL=github-facade-codes.store.js.map

package/dist/modules/marketplace/github-facade/github-facade-codes.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-codes.store.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-codes.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAuC7D,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,EAAY;QAAZ,OAAE,GAAF,EAAE,CAAU;IAAG,CAAC;IAE7C,KAAK,CAAC,GAAG,CAAC,IAAuB;QAC/B,MAAM,KAAK,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;aACzC,kBAAkB,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACrB,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACrB,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;CACF;AAED,mEAAmE;AACnE,SAAS,IAAI,CAAC,QAAgB;IAC5B,OAAO,GAAG,CACR,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACxC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,EACpC,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAA0C;IAC3D,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACrB,IAAI,GAAG,IAAI,GAAG,EAA2D,CAAC;IAE3F,KAAK,CAAC,GAAG,CAAC,IAAuB;QAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,8DAA8D;IAC9D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAEO,QAAQ,CAAC,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG;gBAAE,OAAO,GAAG,CAAC;QACxG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,KAAK,CAAC,GAAoD;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC"}