@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/marketplace/git-http.routes.js

@@ -0,0 +1,192 @@
+import express from 'express';
+import { logger } from '../../shared/logging.js';
+const log = logger('marketplace');
+import { spawn } from 'node:child_process';
+import '../tool-auth/external-api-key.interface.js'; // Express Request augmentation (req.externalApiKeyId)
+/**
+ * The per-user marketplace as a git remote:
+ *
+ *   git clone https://key:<connection-key>@<host>/git/marketplace.git
+ *
+ * Anything that speaks git's smart HTTP protocol — Claude Code, Codex, `npx
+ * skills`, plain git — clones a repository whose `main` is the caller's
+ * compiled tree. The route authenticates, brings the caller's namespace up to
+ * date (`MarketplaceRepoService.ensureCompiled`), and hands the request to
+ * `git http-backend` with `GIT_NAMESPACE` set, so git itself serves the
+ * protocol and only that namespace's refs exist as far as the client can tell.
+ *
+ * AUTH: HTTP Basic with the connection key as the password (the username is
+ * anything — git sends whatever the URL carried), or the key as a Bearer
+ * token. The same keys the MCP endpoint takes, the same service resolving
+ * them, and the same metering stamp (`req.externalApiKeyId`), so a key's
+ * `lastUsedAt` moves when an agent refreshes its plugins. A 401 challenges
+ * with Basic so a client without credentials prompts for them.
+ *
+ * READ-ONLY: the receive-pack service is refused here by name, and the bare
+ * repository pins `http.receivepack=false` for good measure — a push would
+ * otherwise be enabled by http-backend the moment REMOTE_USER is set.
+ */
+export function createMarketplaceGitRoutes(deps) {
+    const { repo, keys, mountPath } = deps;
+    const router = express.Router();
+    const repoRoute = `/${repo.repoName}`;
+    const challenge = (res, message) => {
+        res.setHeader('WWW-Authenticate', 'Basic realm="hexis-marketplace"');
+        res.status(401).type('text/plain').send(message);
+    };
+    /** The connection key out of Basic (`user:key`, `key:` or `:key`) or Bearer. */
+    const keyOf = (header) => {
+        if (!header)
+            return null;
+        const space = header.indexOf(' ');
+        if (space < 0)
+            return null;
+        const scheme = header.slice(0, space).toLowerCase();
+        const value = header.slice(space + 1).trim();
+        if (scheme === 'bearer')
+            return value || null;
+        if (scheme !== 'basic')
+            return null;
+        let decoded;
+        try {
+            decoded = Buffer.from(value, 'base64').toString('utf-8');
+        }
+        catch {
+            return null;
+        }
+        const colon = decoded.indexOf(':');
+        const user = colon < 0 ? decoded : decoded.slice(0, colon);
+        const pass = colon < 0 ? '' : decoded.slice(colon + 1);
+        // Either half may carry the key: `https://key:<k>@` puts it in the
+        // password, `https://<k>@` in the username.
+        if (pass && keys.looksLikeExternalApiKey(pass))
+            return pass;
+        if (user && keys.looksLikeExternalApiKey(user))
+            return user;
+        return pass || user || null;
+    };
+    router.all(`${repoRoute}{/*rest}`, async (req, res) => {
+        const service = String(req.query.service ?? '');
+        const rest = `/${[].concat(req.params.rest ?? []).join('/')}`;
+        // Refuse writes before touching anything — by service name on info/refs,
+        // and by endpoint on the POST.
+        if (service === 'git-receive-pack' || rest === '/git-receive-pack') {
+            res.status(403).type('text/plain').send('This repository is read-only.');
+            return;
+        }
+        const key = keyOf(req.headers.authorization);
+        if (!key || !keys.looksLikeExternalApiKey(key)) {
+            challenge(res, 'A connection key is required: https://key:<connection-key>@<host>/git/marketplace.git');
+            return;
+        }
+        let resolved;
+        try {
+            resolved = await keys.verifyAndLoadToken(key);
+        }
+        catch (err) {
+            log.error('connection-key verification failed:', { err });
+            res.status(500).type('text/plain').send('Authentication backend unavailable');
+            return;
+        }
+        if (!resolved) {
+            challenge(res, 'Invalid or revoked connection key');
+            return;
+        }
+        req.userId = resolved.user.id;
+        req.userEmail = resolved.user.email;
+        req.externalApiKeyId = resolved.tokenId;
+        let ensured;
+        try {
+            ensured = await repo.ensureCompiled({ id: resolved.user.id, email: resolved.user.email });
+        }
+        catch (err) {
+            log.error('compile failed:', { err });
+            res.status(500).type('text/plain').send('Could not prepare your marketplace');
+            return;
+        }
+        // CGI, as git documents it. PATH_INFO is the path below GIT_PROJECT_ROOT
+        // — `/marketplace.git/info/refs` — regardless of where we are mounted.
+        const query = req.url.includes('?') ? req.url.slice(req.url.indexOf('?') + 1) : '';
+        const env = {
+            ...process.env,
+            GIT_PROJECT_ROOT: repo.projectRoot,
+            GIT_HTTP_EXPORT_ALL: '1',
+            GIT_NAMESPACE: ensured.namespace,
+            PATH_INFO: `${repoRoute}${rest}`,
+            REQUEST_METHOD: req.method,
+            QUERY_STRING: query,
+            CONTENT_TYPE: req.headers['content-type'] ?? '',
+            REMOTE_USER: resolved.user.email,
+            REMOTE_ADDR: req.ip ?? '',
+            SERVER_PROTOCOL: 'HTTP/1.1',
+            HTTP_HOST: req.headers.host ?? '',
+            SCRIPT_NAME: mountPath,
+        };
+        if (req.headers['content-length'])
+            env.CONTENT_LENGTH = String(req.headers['content-length']);
+        if (req.headers['content-encoding'])
+            env.HTTP_CONTENT_ENCODING = String(req.headers['content-encoding']);
+        if (req.headers['git-protocol'])
+            env.HTTP_GIT_PROTOCOL = String(req.headers['git-protocol']);
+        const child = spawn('git', ['http-backend'], { env, stdio: ['pipe', 'pipe', 'pipe'] });
+        child.stderr.on('data', (chunk) => log.warn(`http-backend: ${chunk.toString('utf-8').trim()}`));
+        child.on('error', (err) => {
+            log.error('could not run git http-backend:', { err });
+            if (!res.headersSent)
+                res.status(500).type('text/plain').send('git is unavailable');
+        });
+        req.pipe(child.stdin);
+        req.on('aborted', () => child.kill());
+        // Parse the CGI header block (`Status:`, `Content-Type:`, …) off stdout,
+        // then stream the body straight through.
+        let headerBuf = Buffer.alloc(0);
+        let headersDone = false;
+        // Backpressure: a slow client must not make Node buffer a whole pack. One
+        // path for every body write, the remainder of the header chunk included.
+        const writeBody = (bytes) => {
+            if (!res.write(bytes)) {
+                child.stdout.pause();
+                res.once('drain', () => child.stdout.resume());
+            }
+        };
+        child.stdout.on('data', (chunk) => {
+            if (headersDone) {
+                writeBody(chunk);
+                return;
+            }
+            headerBuf = Buffer.concat([headerBuf, chunk]);
+            const cut = headerBuf.indexOf('\r\n\r\n') >= 0 ? headerBuf.indexOf('\r\n\r\n') : headerBuf.indexOf('\n\n');
+            if (cut < 0)
+                return;
+            const sepLen = headerBuf.indexOf('\r\n\r\n') >= 0 ? 4 : 2;
+            const head = headerBuf.subarray(0, cut).toString('utf-8');
+            let status = 200;
+            for (const line of head.split(/\r?\n/)) {
+                const colon = line.indexOf(':');
+                if (colon < 0)
+                    continue;
+                const name = line.slice(0, colon).trim();
+                const value = line.slice(colon + 1).trim();
+                if (name.toLowerCase() === 'status')
+                    status = Number.parseInt(value, 10) || 200;
+                else
+                    res.setHeader(name, value);
+            }
+            res.status(status);
+            headersDone = true;
+            const body = headerBuf.subarray(cut + sepLen);
+            if (body.length > 0)
+                writeBody(body);
+        });
+        child.stdout.on('end', () => {
+            if (!headersDone) {
+                if (!res.headersSent)
+                    res.status(502).type('text/plain').send('git http-backend produced no response');
+                return;
+            }
+            res.end();
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=git-http.routes.js.map

package/dist/modules/marketplace/git-http.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-http.routes.js","sourceRoot":"","sources":["../../../src/modules/marketplace/git-http.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,4CAA4C,CAAC,CAAC,sDAAsD;AAQ3G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEtC,MAAM,SAAS,GAAG,CAAC,GAAqB,EAAE,OAAe,EAAE,EAAE;QAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,gFAAgF;IAChF,MAAM,KAAK,GAAG,CAAC,MAA0B,EAAiB,EAAE;QAC1D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,IAAI,IAAI,CAAC;QAC9C,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACvD,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,IAAI,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;IAC9B,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAK,EAAe,CAAC,MAAM,CAAE,GAAG,CAAC,MAAuC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9G,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,OAAO,KAAK,kBAAkB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,EAAE,uFAAuF,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,IAAI,QAAoD,CAAC;QACzD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;QAExC,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,GAAG,GAAsB;YAC7B,GAAG,OAAO,CAAC,GAAG;YACd,gBAAgB,EAAE,IAAI,CAAC,WAAW;YAClC,mBAAmB,EAAE,GAAG;YACxB,aAAa,EAAE,OAAO,CAAC,SAAS;YAChC,SAAS,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE;YAChC,cAAc,EAAE,GAAG,CAAC,MAAM;YAC1B,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE;YAC/C,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAChC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;YACzB,eAAe,EAAE,UAAU;YAC3B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;YACjC,WAAW,EAAE,SAAS;SACvB,CAAC;QACF,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC9F,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAAE,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACzG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAE7F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACxG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtC,yEAAyE;QACzE,yCAAyC;QACzC,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,WAAW,EAAE,CAAC;gBAChB,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3G,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,MAAM,GAAG,GAAG,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,KAAK,GAAG,CAAC;oBAAE,SAAS;gBACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ;oBAAE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;;oBAC3E,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnB,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.d.ts

@@ -0,0 +1,33 @@
+import express from 'express';
+import '../../auth/auth.middleware.js';
+import { type GitHubFacadeCredentialsService } from './github-facade-credentials.service.js';
+export interface GitHubFacadeAdminRoutesDeps {
+    credentials: GitHubFacadeCredentialsService;
+    isAdmin(email: string | undefined): Promise<boolean>;
+    /** The deployment's public address; only its host is shown. */
+    publicUrl: string;
+    /** The marketplace URL people paste — the same one Claude Code clones. */
+    marketplaceUrl: string;
+}
+/**
+ * What an Owner needs to register this deployment in Claude's admin settings
+ * as a GitHub Enterprise Server, in the fields that form has — and the one
+ * verb on it, rotate. Admins only: the client secret is what makes claude.ai
+ * trust the token exchange. Never cached: after a rotation or a sign-out no
+ * copy of the old secrets may linger in a browser or a proxy.
+ *
+ *   GET  /api/admin/github-facade               the credentials and the two URLs
+ *   POST /api/admin/github-facade/rotate        new credentials, all of them
+ *   PUT  /api/admin/github-facade/registration  `{ registered }` — an admin says so
+ *
+ * And one read that is NOT admin-only, because the External agent access page
+ * shows every signed-in person either the tutorial or "an admin has to set
+ * this up first":
+ *
+ *   GET  /api/github-facade/registration        `{ registered: boolean }`, nothing else
+ *
+ * That answer is built from a boolean, never from the credentials object, so
+ * no future field on the credentials can ride along into it.
+ */
+export declare function createGitHubFacadeAdminRoutes(deps: GitHubFacadeAdminRoutesDeps): express.Router;
+//# sourceMappingURL=github-facade-admin.routes.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-admin.routes.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-admin.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,+BAA+B,CAAC;AACvC,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,wCAAwC,CAAC;AAEhD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,8BAA8B,CAAC;IAC5C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAsE/F"}

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.js

@@ -0,0 +1,88 @@
+import express from 'express';
+import { logger } from '../../../shared/logging.js';
+const log = logger('github-facade');
+import '../../auth/auth.middleware.js'; // Express Request.userId / userEmail augmentation
+import { GitHubFacadeUnavailableError, } from './github-facade-credentials.service.js';
+/**
+ * What an Owner needs to register this deployment in Claude's admin settings
+ * as a GitHub Enterprise Server, in the fields that form has — and the one
+ * verb on it, rotate. Admins only: the client secret is what makes claude.ai
+ * trust the token exchange. Never cached: after a rotation or a sign-out no
+ * copy of the old secrets may linger in a browser or a proxy.
+ *
+ *   GET  /api/admin/github-facade               the credentials and the two URLs
+ *   POST /api/admin/github-facade/rotate        new credentials, all of them
+ *   PUT  /api/admin/github-facade/registration  `{ registered }` — an admin says so
+ *
+ * And one read that is NOT admin-only, because the External agent access page
+ * shows every signed-in person either the tutorial or "an admin has to set
+ * this up first":
+ *
+ *   GET  /api/github-facade/registration        `{ registered: boolean }`, nothing else
+ *
+ * That answer is built from a boolean, never from the credentials object, so
+ * no future field on the credentials can ride along into it.
+ */
+export function createGitHubFacadeAdminRoutes(deps) {
+    const router = express.Router();
+    const requireAdmin = async (req, res, next) => {
+        if (!(await deps.isAdmin(req.userEmail))) {
+            res.status(403).json({ error: 'Admins only' });
+            return;
+        }
+        next();
+    };
+    const describe = async () => {
+        const creds = await deps.credentials.ensure();
+        return {
+            host: new URL(deps.publicUrl).host,
+            appId: creds.appId,
+            clientId: creds.clientId,
+            clientSecret: creds.clientSecret,
+            webhookSecret: creds.webhookSecret,
+            privateKeyPem: creds.privateKeyPem,
+            marketplaceUrl: deps.marketplaceUrl,
+            createdAt: creds.createdAt.getTime(),
+            rotatedAt: creds.rotatedAt ? creds.rotatedAt.getTime() : null,
+        };
+    };
+    const send = async (res, body) => {
+        try {
+            const payload = await body();
+            res.setHeader('Cache-Control', 'no-store');
+            res.json(payload);
+        }
+        catch (err) {
+            if (err instanceof GitHubFacadeUnavailableError) {
+                res.status(409).json({ error: err.message });
+                return;
+            }
+            log.error('admin route failed:', { err });
+            res.status(500).json({ error: 'Internal error' });
+        }
+    };
+    router.get('/admin/github-facade', requireAdmin, (_req, res) => send(res, describe));
+    router.post('/admin/github-facade/rotate', requireAdmin, (_req, res) => send(res, async () => {
+        await deps.credentials.rotate();
+        return describe();
+    }));
+    router.get('/github-facade/registration', (req, res) => {
+        // Mounted behind the session middleware; this is belt and braces for a
+        // mount that forgets it — anonymous callers learn nothing.
+        if (!req.userId) {
+            res.status(401).json({ error: 'Sign in first' });
+            return;
+        }
+        return send(res, async () => ({ registered: await deps.credentials.isRegistered() }));
+    });
+    router.put('/admin/github-facade/registration', requireAdmin, (req, res) => {
+        const registered = req.body?.registered;
+        if (typeof registered !== 'boolean') {
+            res.status(400).json({ error: '`registered` must be true or false' });
+            return;
+        }
+        return send(res, async () => ({ registered: await deps.credentials.setRegistered(registered) }));
+    });
+    return router;
+}
+//# sourceMappingURL=github-facade-admin.routes.js.map

package/dist/modules/marketplace/github-facade/github-facade-admin.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-admin.routes.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-admin.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AACpC,OAAO,+BAA+B,CAAC,CAAC,kDAAkD;AAC1F,OAAO,EACL,4BAA4B,GAE7B,MAAM,wCAAwC,CAAC;AAWhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAiC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;SAC9D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,GAAqB,EAAE,IAA4B,EAAE,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAA4B,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAErF,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACrE,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,UAAU,GAAI,GAAG,CAAC,IAA6C,EAAE,UAAU,CAAC;QAClF,IAAI,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/marketplace/github-facade/github-facade-codes.store.d.ts

@@ -0,0 +1,59 @@
+import type { Database } from '../../database/connection.js';
+/**
+ * A one-time code the consent page issued, waiting for Anthropic's backend
+ * to exchange it. Looked up by the code's hash; the plaintext travels once,
+ * in the redirect.
+ */
+export interface PendingFacadeCode {
+    codeHash: string;
+    userId: string;
+    clientId: string;
+    redirectUri: string;
+    expiresAt: Date;
+}
+/**
+ * Where pending codes live. The database in production, so the consent
+ * finish on one replica and the exchange on another see the same row.
+ *
+ * The rule "one live code per person" is the TABLE'S: the person is its
+ * primary key, so issuing is an upsert — the newest code overwrites the last
+ * in one statement, two finishes racing each other cannot both leave a row
+ * behind, and the table holds at most one row per user, which goes when the
+ * user does. That is the whole bound; nothing here ever sweeps, and no
+ * rotation of the client id can strand a row, because the client id is data
+ * the exchange checks rather than part of the key. Spending is one
+ * conditional update: the first exchange wins, on whichever replica, and
+ * every later attempt finds the code spent. Nothing in memory takes part in
+ * either guarantee.
+ */
+export interface GitHubFacadeCodeStore {
+    /** Store a fresh code, replacing whatever the same person had. */
+    put(code: PendingFacadeCode): Promise<void>;
+    /** The live (unspent, unexpired) code with this hash, without spending it. */
+    peek(codeHash: string): Promise<PendingFacadeCode | null>;
+    /** Spend the code if it is live; null when it was not (unknown, spent, expired). */
+    consume(codeHash: string): Promise<PendingFacadeCode | null>;
+}
+export declare class DbGitHubFacadeCodeStore implements GitHubFacadeCodeStore {
+    private readonly db;
+    constructor(db: Database);
+    put(code: PendingFacadeCode): Promise<void>;
+    peek(codeHash: string): Promise<PendingFacadeCode | null>;
+    consume(codeHash: string): Promise<PendingFacadeCode | null>;
+}
+/**
+ * For tests: the same rules over a map keyed the way the table is. Share one
+ * instance to model shared storage. Check-and-mark is synchronous, as the
+ * database's conditional update is atomic: two exchanges of one code cannot
+ * both win here either.
+ */
+export declare class MemoryGitHubFacadeCodeStore implements GitHubFacadeCodeStore {
+    private readonly rows;
+    put(code: PendingFacadeCode): Promise<void>;
+    peek(codeHash: string): Promise<PendingFacadeCode | null>;
+    consume(codeHash: string): Promise<PendingFacadeCode | null>;
+    /** How many rows the store holds — at most one per person. */
+    get size(): number;
+    private findLive;
+}
+//# sourceMappingURL=github-facade-codes.store.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade-codes.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-codes.store.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-codes.store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAG7D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC1D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,qBAAa,uBAAwB,YAAW,qBAAqB;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAEnC,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAe3C,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASzD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAQnE;AAqBD;;;;;GAKG;AACH,qBAAa,2BAA4B,YAAW,qBAAqB;IACvE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsE;IAErF,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAKzD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAOlE,8DAA8D;IAC9D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,QAAQ;CAOjB"}

package/dist/modules/marketplace/github-facade/github-facade-codes.store.js

@@ -0,0 +1,96 @@
+import { and, eq, gt, isNull } from 'drizzle-orm';
+import { githubFacadeCodes } from '../../database/schema.js';
+export class DbGitHubFacadeCodeStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async put(code) {
+        const fresh = {
+            clientId: code.clientId,
+            codeHash: code.codeHash,
+            redirectUri: code.redirectUri,
+            expiresAt: code.expiresAt,
+            consumedAt: null,
+            createdAt: new Date(),
+        };
+        await this.db
+            .insert(githubFacadeCodes)
+            .values({ userId: code.userId, ...fresh })
+            .onConflictDoUpdate({ target: githubFacadeCodes.userId, set: fresh });
+    }
+    async peek(codeHash) {
+        const [row] = await this.db
+            .select()
+            .from(githubFacadeCodes)
+            .where(live(codeHash))
+            .limit(1);
+        return row ? toPending(row) : null;
+    }
+    async consume(codeHash) {
+        const [row] = await this.db
+            .update(githubFacadeCodes)
+            .set({ consumedAt: new Date() })
+            .where(live(codeHash))
+            .returning();
+        return row ? toPending(row) : null;
+    }
+}
+/** The one definition of "live": this hash, unspent, unexpired. */
+function live(codeHash) {
+    return and(eq(githubFacadeCodes.codeHash, codeHash), isNull(githubFacadeCodes.consumedAt), gt(githubFacadeCodes.expiresAt, new Date()));
+}
+function toPending(row) {
+    return {
+        codeHash: row.codeHash,
+        userId: row.userId,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        expiresAt: row.expiresAt,
+    };
+}
+/**
+ * For tests: the same rules over a map keyed the way the table is. Share one
+ * instance to model shared storage. Check-and-mark is synchronous, as the
+ * database's conditional update is atomic: two exchanges of one code cannot
+ * both win here either.
+ */
+export class MemoryGitHubFacadeCodeStore {
+    rows = new Map();
+    async put(code) {
+        this.rows.set(code.userId, { ...code, consumedAt: null });
+    }
+    async peek(codeHash) {
+        const row = this.findLive(codeHash);
+        return row ? strip(row) : null;
+    }
+    async consume(codeHash) {
+        const row = this.findLive(codeHash);
+        if (!row)
+            return null;
+        row.consumedAt = new Date();
+        return strip(row);
+    }
+    /** How many rows the store holds — at most one per person. */
+    get size() {
+        return this.rows.size;
+    }
+    findLive(codeHash) {
+        const now = Date.now();
+        for (const row of this.rows.values()) {
+            if (row.codeHash === codeHash && row.consumedAt === null && row.expiresAt.getTime() > now)
+                return row;
+        }
+        return null;
+    }
+}
+function strip(row) {
+    return {
+        codeHash: row.codeHash,
+        userId: row.userId,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        expiresAt: row.expiresAt,
+    };
+}
+//# sourceMappingURL=github-facade-codes.store.js.map

package/dist/modules/marketplace/github-facade/github-facade-codes.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-codes.store.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-codes.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAuC7D,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,EAAY;QAAZ,OAAE,GAAF,EAAE,CAAU;IAAG,CAAC;IAE7C,KAAK,CAAC,GAAG,CAAC,IAAuB;QAC/B,MAAM,KAAK,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;aACzC,kBAAkB,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACrB,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACrB,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;CACF;AAED,mEAAmE;AACnE,SAAS,IAAI,CAAC,QAAgB;IAC5B,OAAO,GAAG,CACR,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACxC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,EACpC,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAA0C;IAC3D,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACrB,IAAI,GAAG,IAAI,GAAG,EAA2D,CAAC;IAE3F,KAAK,CAAC,GAAG,CAAC,IAAuB;QAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,8DAA8D;IAC9D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAEO,QAAQ,CAAC,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG;gBAAE,OAAO,GAAG,CAAC;QACxG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,KAAK,CAAC,GAAoD;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC"}

package/dist/modules/marketplace/github-facade/github-facade-credentials.service.d.ts

@@ -0,0 +1,126 @@
+import type { Database } from '../../database/connection.js';
+import type { TokenCrypto } from '../../../shared/token-crypto.js';
+/**
+ * What Claude's "Add manually" form for a GitHub Enterprise Server asks an
+ * Owner to paste, and what the token exchange later checks: the identity
+ * this deployment presents to claude.ai as if it were a GitHub App.
+ *
+ * Every field is generated HERE, once per deployment — nothing is registered
+ * anywhere else, because there is no GitHub: hexis is the host Claude talks
+ * to. The private key is handed over because the form requires one; the
+ * user-added marketplace flow never signs with it (the observed contract is
+ * the OAuth pair plus three REST calls), but a future organization
+ * marketplace would, and rotating everything together is simpler than
+ * explaining which half matters.
+ */
+export interface GitHubFacadeCredentials {
+    appId: string;
+    clientId: string;
+    clientSecret: string;
+    webhookSecret: string;
+    privateKeyPem: string;
+    publicKeyPem: string;
+    createdAt: Date;
+    rotatedAt: Date | null;
+}
+/**
+ * Where the one credentials row lives — the database in production, memory
+ * in tests. THE row, not a copy of it: every replica reads the store on
+ * every use, so a rotation on one replica is what every other replica
+ * checks the very next exchange. The reads are rare (a connect, an admin
+ * page), and a cache would be a second source of truth with no invalidation.
+ *
+ * Both writes are conditional, so two replicas writing at once cannot
+ * disagree about what is stored: creation happens only when no row exists,
+ * and a rotation replaces only the set the caller was looking at. Either way
+ * the caller gets back what the store holds afterwards, never what it sent.
+ */
+export interface GitHubFacadeCredentialsStore {
+    load(): Promise<GitHubFacadeCredentials | null>;
+    /**
+     * Store `creds` only if no row exists yet, and return whichever row
+     * exists afterwards — so two replicas initialising at once agree on one
+     * set, and the loser's generated values are simply dropped.
+     */
+    createIfAbsent(creds: GitHubFacadeCredentials): Promise<GitHubFacadeCredentials>;
+    /**
+     * Replace the row only while it still carries `expectedClientId`, and
+     * return what is stored afterwards. Two admins rotating at once: the first
+     * write wins, the second finds a different client id, writes nothing, and
+     * is shown the winner's set — the only one Claude will accept.
+     */
+    replaceIfCurrent(expectedClientId: string, creds: GitHubFacadeCredentials): Promise<GitHubFacadeCredentials>;
+    /**
+     * When an admin marked the deployment registered with Claude, or null.
+     * Reads the one unsealed column only: answering "is it registered?" must
+     * never decrypt a secret, and must work without the secrets key at all.
+     */
+    registeredAt(): Promise<Date | null>;
+    /** Record (a date) or clear (null) the registration on the existing row. */
+    setRegisteredAt(at: Date | null): Promise<void>;
+}
+/**
+ * The database-backed store. Secrets are sealed with the deployment's secrets
+ * key, exactly as stored settings are; without that key there is nowhere safe
+ * to keep a client secret, so the store refuses rather than writing plaintext.
+ */
+export declare class DbGitHubFacadeCredentialsStore implements GitHubFacadeCredentialsStore {
+    private readonly db;
+    private readonly crypto;
+    constructor(db: Database, crypto: TokenCrypto | null);
+    load(): Promise<GitHubFacadeCredentials | null>;
+    createIfAbsent(creds: GitHubFacadeCredentials): Promise<GitHubFacadeCredentials>;
+    replaceIfCurrent(expectedClientId: string, creds: GitHubFacadeCredentials): Promise<GitHubFacadeCredentials>;
+    registeredAt(): Promise<Date | null>;
+    setRegisteredAt(at: Date | null): Promise<void>;
+    private stored;
+    private seal;
+    private requireCrypto;
+}
+export declare class GitHubFacadeUnavailableError extends Error {
+    constructor(message: string);
+}
+/**
+ * Generates the credentials on first use and reads them from the store on
+ * every use after that. No in-process copy: the store is the one place the
+ * truth lives, whichever replica asks.
+ */
+export declare class GitHubFacadeCredentialsService {
+    private readonly store;
+    constructor(store: GitHubFacadeCredentialsStore);
+    /** The credentials, generated on first use. */
+    ensure(): Promise<GitHubFacadeCredentials>;
+    /**
+     * New credentials, all of them — replacing the set this call read, and
+     * returning whatever is stored afterwards. Every registration on the
+     * Claude side stops matching at once, which is the point of rotating: the
+     * Owner re-enters the new set, and connected users' tokens (connection
+     * keys) are untouched, since those are ours.
+     */
+    rotate(): Promise<GitHubFacadeCredentials>;
+    /**
+     * Whether an admin has said this deployment is registered with their Claude
+     * organization. A boolean and nothing else — this is what every signed-in
+     * person may learn, so the External agent access page can tell them whether
+     * the Cowork route is open yet. No row yet means nobody has even seen the
+     * credentials, so it cannot be registered.
+     */
+    isRegistered(): Promise<boolean>;
+    /**
+     * Mark the deployment registered (or not). Rotation leaves this alone: it
+     * says the Claude side needs the new values, which is the rotate dialog's
+     * job to tell the admin, not a reason to hide the tutorial from everyone.
+     */
+    setRegistered(registered: boolean): Promise<boolean>;
+}
+/** For tests: the row kept in memory, with the same conditional writes. */
+export declare class MemoryGitHubFacadeCredentialsStore implements GitHubFacadeCredentialsStore {
+    private row;
+    private registered;
+    load(): Promise<GitHubFacadeCredentials | null>;
+    registeredAt(): Promise<Date | null>;
+    setRegisteredAt(at: Date | null): Promise<void>;
+    createIfAbsent(creds: GitHubFacadeCredentials): Promise<GitHubFacadeCredentials>;
+    replaceIfCurrent(expectedClientId: string, creds: GitHubFacadeCredentials): Promise<GitHubFacadeCredentials>;
+}
+//# sourceMappingURL=github-facade-credentials.service.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade-credentials.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-credentials.service.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-credentials.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAChD;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACjF;;;;;OAKG;IACH,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7G;;;;OAIG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACrC,4EAA4E;IAC5E,eAAe,CAAC,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAID;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,4BAA4B;IAE/E,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,WAAW,GAAG,IAAI;IAGvC,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAoB/C,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQhF,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQ5G,YAAY,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IASpC,eAAe,CAAC,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAOvC,MAAM;IAMpB,OAAO,CAAC,IAAI;IAcZ,OAAO,CAAC,aAAa;CAQtB;AAED,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,qBAAa,8BAA8B;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,4BAA4B;IAEhE,+CAA+C;IACzC,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAMhD;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAKhD;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAItC;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAO3D;AAsBD,2EAA2E;AAC3E,qBAAa,kCAAmC,YAAW,4BAA4B;IACrF,OAAO,CAAC,GAAG,CAAwC;IACnD,OAAO,CAAC,UAAU,CAAqB;IACjC,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAG/C,YAAY,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAGpC,eAAe,CAAC,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAG/C,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIhF,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAInH"}