@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/kb-sync/kb-sync.service.js

@@ -0,0 +1,185 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('sync');
+import { sanitizeError } from '../workflow/sanitize-error.js';
+/**
+ * Runs remote syncs one at a time and folds everything that arrives
+ * mid-run into ONE follow-up.
+ *
+ * Why coalesce: a git host fires several hooks for one event — Azure DevOps
+ * sends a push, a PR-updated and a PR-merged within a second of each other —
+ * and each would otherwise queue behind the workspace mutex to pull the same
+ * tree again. The follow-up pulls the union of every request that arrived
+ * during the run (an "all" absorbs the rest).
+ *
+ * But each caller is answered for the branches IT asked about. The endpoint
+ * promises to fail exactly when the caller's branch is not in sync; a hook
+ * for branch A answered with branch B's conflict would fail the wrong
+ * subscription — and a host that disables subscriptions after repeated
+ * failures would disable the wrong one.
+ *
+ * Branches are pulled sequentially. N is small (only cloned branches count),
+ * the per-clone mutex serialises them anyway, and one slow origin round-trip
+ * at a time keeps the process calm during a burst.
+ */
+export class KbSyncService {
+    workflow;
+    workspaces;
+    now;
+    inFlight = null;
+    /** Everyone who arrived mid-run, each with what they asked for. */
+    waiters = [];
+    last = null;
+    constructor(workflow, workspaces, now = () => Date.now()) {
+        this.workflow = workflow;
+        this.workspaces = workspaces;
+        this.now = now;
+    }
+    lastSync() {
+        return this.last;
+    }
+    sync(request) {
+        if (!this.inFlight)
+            return this.start(request);
+        return new Promise((resolve, reject) => {
+            // Copied on entry: the caller keeps its array, and a caller that reuses
+            // or edits it before the follow-up runs must not change what is pulled
+            // or what it is answered for.
+            const branches = request.branches === 'all' ? 'all' : [...request.branches];
+            this.waiters.push({ branches, by: request.by, resolve, reject });
+        });
+    }
+    start(request) {
+        const run = this.run(request);
+        this.inFlight = run.catch(() => undefined).finally(() => {
+            this.inFlight = null;
+            this.drain();
+        });
+        return run;
+    }
+    /**
+     * Run ONE follow-up for everyone who arrived during the last run: the union
+     * of their branches, then each waiter answered from its own share of the
+     * result — never from another caller's branches.
+     */
+    drain() {
+        if (this.waiters.length === 0)
+            return;
+        const waiters = this.waiters;
+        this.waiters = [];
+        const union = new Set();
+        let all = false;
+        const by = new Set();
+        for (const w of waiters) {
+            if (w.branches === 'all')
+                all = true;
+            else
+                for (const b of w.branches)
+                    union.add(b);
+            if (w.by)
+                by.add(w.by);
+        }
+        const request = {
+            branches: all ? 'all' : [...union],
+            by: by.size > 0 ? [...by].join(', ') : undefined,
+        };
+        this.start(request).then((result) => {
+            for (const w of waiters)
+                w.resolve(KbSyncService.subsetFor(result, w.branches));
+        }, (err) => {
+            for (const w of waiters)
+                w.reject(err);
+        });
+    }
+    /** The part of a union run that answers one caller: its branches, and its status over them. */
+    static subsetFor(result, branches) {
+        if (branches === 'all')
+            return result;
+        const wanted = new Set(branches);
+        const results = result.results.filter((r) => wanted.has(r.branch));
+        return {
+            status: KbSyncService.statusOf(results),
+            results,
+            changeRequests: result.changeRequests,
+        };
+    }
+    static statusOf(results) {
+        const clean = results.every((r) => r.outcome === 'updated' ||
+            r.outcome === 'up-to-date' ||
+            r.outcome === 'not-cloned' ||
+            r.outcome === 'remote-gone');
+        return clean ? 'synced' : 'partial';
+    }
+    async run(request) {
+        const known = await this.workspaces.listClonedWorkspaces();
+        const byBranch = new Map(known.map((w) => [w.branch, w.id]));
+        const targets = request.branches === 'all'
+            ? known.map((w) => ({ branch: w.branch, id: w.id }))
+            : request.branches.map((branch) => ({ branch, id: byBranch.get(branch) ?? null }));
+        const unreadable = new Map(known.filter((w) => w.unreadable).map((w) => [w.branch, w.unreadable]));
+        const results = [];
+        for (const { branch, id } of targets) {
+            if (id === null) {
+                results.push({ branch, outcome: 'not-cloned' });
+                continue;
+            }
+            const cannotRead = unreadable.get(branch);
+            if (cannotRead) {
+                results.push({ branch, outcome: 'error', error: cannotRead });
+                continue;
+            }
+            let outcome;
+            try {
+                outcome = await this.workflow.syncWorkspaceFromRemote(id);
+            }
+            catch (err) {
+                // The workflow step promises outcomes, not throws — but one broken
+                // clone must never take the other branches, the sweep, or every
+                // coalesced caller down with it, so the promise is enforced here too.
+                const message = sanitizeError(err);
+                log.error(`unexpected failure syncing "${branch}": ${message}`);
+                outcome = { branch, outcome: 'error', error: message };
+            }
+            results.push(outcome);
+            if (outcome.outcome === 'remote-gone') {
+                // The host deleted the branch. Left in place, the stale clone would
+                // fail its fetch on every following full sync — and a webhook host
+                // disables a subscription that keeps failing. The workflow retires it
+                // under the branch-lifecycle lock, after asking origin again, so a
+                // branch recreated since the pull keeps its clone. Best-effort.
+                try {
+                    const removed = await this.workflow.retireRemoteGoneClone(id);
+                    if (removed)
+                        log.info(`removed the clone of "${branch}" — deleted on the host`);
+                    else
+                        log.info(`kept the clone of "${branch}" — it is back on the host, or already gone`);
+                }
+                catch (err) {
+                    log.warn(`could not remove the clone of "${branch}":`, { detail: sanitizeError(err) });
+                }
+            }
+        }
+        // The host may have deleted a branch (an ADO PR completed with "delete
+        // source branch"); the existing sweep closes the Hexis request that
+        // pointed at it. Best-effort — it fails safe by closing nothing.
+        let closedDeletedBranch = 0;
+        try {
+            closedDeletedBranch = await this.workflow.closeChangeRequestsWithDeletedBranches();
+        }
+        catch (err) {
+            log.warn('deleted-branch sweep failed:', { err });
+        }
+        const result = {
+            status: KbSyncService.statusOf(results),
+            results,
+            changeRequests: { closedDeletedBranch },
+        };
+        this.last = {
+            at: this.now(),
+            by: request.by ?? 'unknown',
+            status: result.status,
+            results: [...results],
+        };
+        return result;
+    }
+}
+//# sourceMappingURL=kb-sync.service.js.map

package/dist/modules/kb-sync/kb-sync.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-sync.service.js","sourceRoot":"","sources":["../../../src/modules/kb-sync/kb-sync.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAU9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,aAAa;IAYL;IACA;IACA;IAbX,QAAQ,GAA4B,IAAI,CAAC;IACjD,mEAAmE;IAC3D,OAAO,GAKV,EAAE,CAAC;IACA,IAAI,GAAoB,IAAI,CAAC;IAErC,YACmB,QAA0B,EAC1B,UAA6B,EAC7B,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAFpC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,eAAU,GAAV,UAAU,CAAmB;QAC7B,QAAG,GAAH,GAAG,CAAiC;IACpD,CAAC;IAEJ,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,OAAoB;QACvB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,wEAAwE;YACxE,uEAAuE;YACvE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,OAAoB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACK,KAAK;QACX,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAElB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,MAAM,EAAE,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK;gBAAE,GAAG,GAAG,IAAI,CAAC;;gBAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,EAAE;gBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAgB;YAC3B,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;YAClC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACjD,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CACtB,CAAC,MAAM,EAAE,EAAE;YACT,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC,CACF,CAAC;IACJ,CAAC;IAED,+FAA+F;IACvF,MAAM,CAAC,SAAS,CAAC,MAAkB,EAAE,QAA0B;QACrE,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;YACvC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,OAA4B;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,OAAO,KAAK,YAAY;YAC1B,CAAC,CAAC,OAAO,KAAK,YAAY;YAC1B,CAAC,CAAC,OAAO,KAAK,aAAa,CAC9B,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,OAAoB;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE7D,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,KAAK;YACxB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAW,CAAC,CAAC,CAAC,CAAC;QAEpG,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,IAAI,OAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,gEAAgE;gBAChE,sEAAsE;gBACtE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnC,GAAG,CAAC,KAAK,CAAC,+BAA+B,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;gBAChE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;gBACtC,oEAAoE;gBACpE,mEAAmE;gBACnE,sEAAsE;gBACtE,mEAAmE;gBACnE,gEAAgE;gBAChE,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;oBAC9D,IAAI,OAAO;wBAAE,GAAG,CAAC,IAAI,CAAC,yBAAyB,MAAM,yBAAyB,CAAC,CAAC;;wBAC3E,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,6CAA6C,CAAC,CAAC;gBAC3F,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,iEAAiE;QACjE,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,mBAAmB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,MAAM,GAAe;YACzB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;YACvC,OAAO;YACP,cAAc,EAAE,EAAE,mBAAmB,EAAE;SACxC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG;YACV,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;SACtB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/modules/kb-sync/sync-auth.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Who may call `POST /api/sync`, decided from the request's credentials.
+ *
+ * Framework-agnostic on purpose (the route hands in plain strings and the
+ * raw body) so the rule is one function with one test, not something spread
+ * across middleware.
+ *
+ * Four credentials are accepted, because the callers cannot all speak the
+ * same one:
+ *
+ *   bearer            `Authorization: Bearer <secret>` — ADO Web Hooks and
+ *                     any pipeline can set a header.
+ *   gitlab-token      `X-Gitlab-Token: <secret>` — what GitLab sends.
+ *   github-signature  `X-Hub-Signature-256: sha256=<hmac of the raw body>` —
+ *                     GitHub and Gitea cannot set headers, only sign.
+ *   admin-session     a browser JWT whose user is an admin, so a "Sync now"
+ *                     button and a curl with your own session both work while
+ *                     the hook is being wired up.
+ *
+ * Every comparison is constant-time. The secret never travels in the URL.
+ */
+export type SyncCredential = {
+    kind: 'bearer' | 'gitlab-token' | 'github-signature';
+} | {
+    kind: 'admin-session';
+    email: string;
+};
+export type SyncAuthResult = {
+    ok: true;
+    credential: SyncCredential;
+} | {
+    ok: false;
+    status: 401 | 503;
+    message: string;
+};
+export interface SyncAuthInput {
+    /** The configured secret, or empty when none is set. */
+    secret: string;
+    authorization?: string;
+    gitlabToken?: string;
+    hubSignature?: string;
+    /** The request body exactly as received — the HMAC is over these bytes. */
+    rawBody?: Buffer;
+}
+export interface SyncSessionVerifier {
+    /** Resolve a browser JWT to its email, or null when it is not one. */
+    verifyJwt(token: string): {
+        email: string;
+    } | null;
+    isAdmin(email: string): Promise<boolean>;
+}
+/**
+ * Shortest secret the endpoint will honour. The setup screen enforces the
+ * same floor on save; this is the boundary that also covers a secret set
+ * through the environment, which no validator ever sees.
+ */
+export declare const MIN_SYNC_SECRET_LENGTH = 16;
+export declare function verifySyncCredential(input: SyncAuthInput, session: SyncSessionVerifier): Promise<SyncAuthResult>;
+//# sourceMappingURL=sync-auth.d.ts.map

package/dist/modules/kb-sync/sync-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-auth.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-sync/sync-auth.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,kBAAkB,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,cAAc,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAMD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAazC,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CA4CzB"}

package/dist/modules/kb-sync/sync-auth.js

@@ -0,0 +1,62 @@
+import { createHmac } from 'node:crypto';
+import { timingSafeStringEqual } from '../auth/password-hash.js';
+const NO_SECRET = 'No sync secret is configured. Set KB_SYNC_SECRET (or the setup screen’s sync secret), ' +
+    'or call this endpoint with an administrator session.';
+/**
+ * Shortest secret the endpoint will honour. The setup screen enforces the
+ * same floor on save; this is the boundary that also covers a secret set
+ * through the environment, which no validator ever sees.
+ */
+export const MIN_SYNC_SECRET_LENGTH = 16;
+const SECRET_TOO_SHORT = `The configured sync secret is shorter than ${MIN_SYNC_SECRET_LENGTH} characters and is not ` +
+    'accepted. Set a longer KB_SYNC_SECRET, or call this endpoint with an administrator session.';
+function signatureMatches(secret, rawBody, header) {
+    const [scheme, hex] = header.split('=', 2);
+    if (scheme !== 'sha256' || !hex)
+        return false;
+    const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
+    return timingSafeStringEqual(expected, hex.toLowerCase());
+}
+export async function verifySyncCredential(input, session) {
+    const configured = input.secret.trim();
+    // A too-short secret is treated as absent for matching purposes and named
+    // as the problem below, so a one-character deployment secret can never be
+    // what lets a caller in.
+    const usable = configured.length >= MIN_SYNC_SECRET_LENGTH;
+    const secret = usable ? configured : '';
+    const bearer = input.authorization?.startsWith('Bearer ')
+        ? input.authorization.slice('Bearer '.length).trim()
+        : '';
+    // A shared secret presented in any of its three shapes.
+    if (secret) {
+        if (bearer && timingSafeStringEqual(bearer, secret)) {
+            return { ok: true, credential: { kind: 'bearer' } };
+        }
+        if (input.gitlabToken && timingSafeStringEqual(input.gitlabToken.trim(), secret)) {
+            return { ok: true, credential: { kind: 'gitlab-token' } };
+        }
+        if (input.hubSignature && input.rawBody && signatureMatches(secret, input.rawBody, input.hubSignature.trim())) {
+            return { ok: true, credential: { kind: 'github-signature' } };
+        }
+    }
+    // An admin's own session, carried as the bearer. Checked after the secret
+    // so a secret that happens to parse as a JWT is never mistaken for one.
+    if (bearer) {
+        const claim = session.verifyJwt(bearer);
+        if (claim && (await session.isAdmin(claim.email))) {
+            return { ok: true, credential: { kind: 'admin-session', email: claim.email } };
+        }
+    }
+    // Nothing matched. Say WHY when the reason is the deployment's, not the
+    // caller's: a hook pointed at an unconfigured endpoint should read "set
+    // the secret", not "wrong secret".
+    if (!secret && (bearer || input.gitlabToken || input.hubSignature)) {
+        return { ok: false, status: 503, message: configured ? SECRET_TOO_SHORT : NO_SECRET };
+    }
+    return {
+        ok: false,
+        status: 401,
+        message: 'A valid sync secret or an administrator session is required.',
+    };
+}
+//# sourceMappingURL=sync-auth.js.map

package/dist/modules/kb-sync/sync-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-auth.js","sourceRoot":"","sources":["../../../src/modules/kb-sync/sync-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA+CjE,MAAM,SAAS,GACb,wFAAwF;IACxF,sDAAsD,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,MAAM,gBAAgB,GACpB,8CAA8C,sBAAsB,yBAAyB;IAC7F,6FAA6F,CAAC;AAEhG,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe,EAAE,MAAc;IACvE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,OAAO,qBAAqB,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAoB,EACpB,OAA4B;IAE5B,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,0EAA0E;IAC1E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,sBAAsB,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QACpD,CAAC,CAAC,EAAE,CAAC;IAEP,wDAAwD;IACxD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,IAAI,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,IAAI,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACxF,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,8DAA8D;KACxE,CAAC;AACJ,CAAC"}

package/dist/modules/kb-sync/sync-payload.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Turn whatever a caller POSTed to `/api/sync` into the branches to sync.
+ *
+ * Pure: no IO, no throwing on foreign shapes. The endpoint is meant to be
+ * pointed at by a webhook subscription whose payload the operator does not
+ * control, so an unrecognised body must degrade to "sync everything" — the
+ * safe answer, and the one an empty pipeline call gets too — never to a 400
+ * that makes the host disable the subscription.
+ *
+ * Recognised shapes:
+ *
+ *   explicit      `{ "branches": ["main", "ali/x"] }`
+ *   azure-devops  `eventType: git.push` → `resource.refUpdates[].name`
+ *                 `eventType: git.pullrequest.*` → `resource.targetRefName`
+ *                 and `resource.sourceRefName`
+ *   github/gitea  `{ "ref": "refs/heads/main" }` (push)
+ *   gitlab        `{ "object_kind": "push", "ref": "refs/heads/main" }`
+ *
+ * Only `refs/heads/*` refs count; a tag push names nothing to sync. A branch
+ * name git would refuse is dropped from a provider payload (the host
+ * produced it, nothing we can do) but reported for an explicit body, where
+ * it is the caller's mistake to fix.
+ */
+export type SyncPayloadSource = 'explicit' | 'azure-devops' | 'github' | 'gitlab' | 'none';
+export interface ParsedSyncPayload {
+    source: SyncPayloadSource;
+    branches: string[] | 'all';
+    /** Explicit-body names git would refuse. Empty for every other source. */
+    invalid: string[];
+}
+export declare function parseSyncPayload(body: unknown): ParsedSyncPayload;
+//# sourceMappingURL=sync-payload.d.ts.map

package/dist/modules/kb-sync/sync-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-payload.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-sync/sync-payload.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE3F,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC3B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+CD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CA+DjE"}

package/dist/modules/kb-sync/sync-payload.js

@@ -0,0 +1,105 @@
+import { assertValidBranchName } from '../kb-fs/branch-name.js';
+const HEADS = 'refs/heads/';
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function branchFromRef(ref) {
+    if (typeof ref !== 'string' || !ref.startsWith(HEADS))
+        return null;
+    const name = ref.slice(HEADS.length);
+    return isValidBranch(name) ? name : null;
+}
+function isValidBranch(name) {
+    try {
+        assertValidBranchName(name);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function unique(names) {
+    return [...new Set(names)];
+}
+/**
+ * How an invalid explicit entry is echoed back. Only primitives are
+ * stringified: `String(obj)` on a JSON object carrying `"toString": 1` throws
+ * ("Cannot convert object to primitive value"), which would turn a caller's
+ * bad body into our 500.
+ */
+function describeInvalid(entry) {
+    if (entry === null)
+        return 'null';
+    switch (typeof entry) {
+        case 'string':
+            return entry.trim() === '' ? '(empty)' : entry;
+        case 'number':
+        case 'boolean':
+        case 'bigint':
+            return String(entry);
+        default:
+            return Array.isArray(entry) ? '(array)' : '(object)';
+    }
+}
+export function parseSyncPayload(body) {
+    if (!isRecord(body))
+        return { source: 'none', branches: 'all', invalid: [] };
+    if ('branches' in body) {
+        const raw = body.branches;
+        if (!Array.isArray(raw))
+            return { source: 'explicit', branches: 'all', invalid: [] };
+        const valid = [];
+        const invalid = [];
+        for (const entry of raw) {
+            if (typeof entry !== 'string' || !entry.trim()) {
+                invalid.push(describeInvalid(entry));
+                continue;
+            }
+            const name = entry.trim();
+            (isValidBranch(name) ? valid : invalid).push(name);
+        }
+        return { source: 'explicit', branches: unique(valid), invalid };
+    }
+    // Azure DevOps service hook. `eventType` names the event; the branches sit
+    // under `resource` in a per-event shape.
+    const eventType = body.eventType;
+    if (typeof eventType === 'string' && isRecord(body.resource)) {
+        const resource = body.resource;
+        if (eventType === 'git.push') {
+            const updates = Array.isArray(resource.refUpdates) ? resource.refUpdates : [];
+            // A DELETION (new object id all zeros) names its branch too: syncing it
+            // is what finds the branch gone and retires the stale clone, instead of
+            // leaving it to fail on some unrelated full sync later.
+            const branches = updates
+                .map((u) => (isRecord(u) ? branchFromRef(u.name) : null))
+                .filter((b) => b !== null);
+            return { source: 'azure-devops', branches: unique(branches), invalid: [] };
+        }
+        if (eventType.startsWith('git.pullrequest.')) {
+            const branches = [branchFromRef(resource.targetRefName), branchFromRef(resource.sourceRefName)]
+                .filter((b) => b !== null);
+            return { source: 'azure-devops', branches: unique(branches), invalid: [] };
+        }
+    }
+    // GitLab events all carry `object_kind`. Only a push (or a tag push, which
+    // names no branch) is a statement about a ref; anything else with a stray
+    // `ref` — a merge request, a pipeline — is not, and takes the "everything"
+    // fallback rather than being read as a push of that ref.
+    if (typeof body.object_kind === 'string') {
+        if (body.object_kind !== 'push' && body.object_kind !== 'tag_push') {
+            return { source: 'none', branches: 'all', invalid: [] };
+        }
+        // A deletion (a push to the null sha) names its branch like any push: the
+        // sync finds it gone and retires the clone.
+        const branch = branchFromRef(body.ref);
+        return { source: 'gitlab', branches: branch ? [branch] : [], invalid: [] };
+    }
+    // GitHub / Gitea push: `ref` at the top level, no `object_kind`. A deletion
+    // (`deleted: true`) names its branch like any push, for the same reason.
+    if (typeof body.ref === 'string') {
+        const branch = branchFromRef(body.ref);
+        return { source: 'github', branches: branch ? [branch] : [], invalid: [] };
+    }
+    return { source: 'none', branches: 'all', invalid: [] };
+}
+//# sourceMappingURL=sync-payload.js.map

package/dist/modules/kb-sync/sync-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-payload.js","sourceRoot":"","sources":["../../../src/modules/kb-sync/sync-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAkChE,MAAM,KAAK,GAAG,aAAa,CAAC;AAE5B,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACjD,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB;YACE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE7E,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IAED,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,wEAAwE;YACxE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,QAAQ,GAAG,OAAO;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACxD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;iBAC5F,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1D,CAAC"}

package/dist/modules/marketplace/git-http.routes.d.ts

@@ -0,0 +1,42 @@
+import express from 'express';
+import type { AuthUser } from '@bevel-software/platform-shared';
+import type { MarketplaceRepoService } from './marketplace-repo.service.js';
+import '../tool-auth/external-api-key.interface.js';
+/** How a bearer string resolves to a user — the connection-key service's shape. */
+export interface MarketplaceKeyResolver {
+    looksLikeExternalApiKey(token: string): boolean;
+    verifyAndLoadToken(plaintext: string): Promise<{
+        tokenId: string;
+        user: AuthUser;
+    } | null>;
+}
+/**
+ * The per-user marketplace as a git remote:
+ *
+ *   git clone https://key:<connection-key>@<host>/git/marketplace.git
+ *
+ * Anything that speaks git's smart HTTP protocol — Claude Code, Codex, `npx
+ * skills`, plain git — clones a repository whose `main` is the caller's
+ * compiled tree. The route authenticates, brings the caller's namespace up to
+ * date (`MarketplaceRepoService.ensureCompiled`), and hands the request to
+ * `git http-backend` with `GIT_NAMESPACE` set, so git itself serves the
+ * protocol and only that namespace's refs exist as far as the client can tell.
+ *
+ * AUTH: HTTP Basic with the connection key as the password (the username is
+ * anything — git sends whatever the URL carried), or the key as a Bearer
+ * token. The same keys the MCP endpoint takes, the same service resolving
+ * them, and the same metering stamp (`req.externalApiKeyId`), so a key's
+ * `lastUsedAt` moves when an agent refreshes its plugins. A 401 challenges
+ * with Basic so a client without credentials prompts for them.
+ *
+ * READ-ONLY: the receive-pack service is refused here by name, and the bare
+ * repository pins `http.receivepack=false` for good measure — a push would
+ * otherwise be enabled by http-backend the moment REMOTE_USER is set.
+ */
+export declare function createMarketplaceGitRoutes(deps: {
+    repo: MarketplaceRepoService;
+    keys: MarketplaceKeyResolver;
+    /** The URL path the router is mounted at, e.g. `/git`. Used for PATH_INFO. */
+    mountPath: string;
+}): express.Router;
+//# sourceMappingURL=git-http.routes.d.ts.map

package/dist/modules/marketplace/git-http.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-http.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/marketplace/git-http.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAK9B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,4CAA4C,CAAC;AAEpD,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC5F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,IAAI,EAAE,sBAAsB,CAAC;IAC7B,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,CAwJjB"}