@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/marketplace/github-facade/github-facade-credentials.service.js

@@ -0,0 +1,192 @@
+import { generateKeyPairSync, randomBytes, randomInt } from 'node:crypto';
+import { and, eq } from 'drizzle-orm';
+import { githubFacadeIdentity } from '../../database/schema.js';
+const ROW_ID = 'default';
+/**
+ * The database-backed store. Secrets are sealed with the deployment's secrets
+ * key, exactly as stored settings are; without that key there is nowhere safe
+ * to keep a client secret, so the store refuses rather than writing plaintext.
+ */
+export class DbGitHubFacadeCredentialsStore {
+    db;
+    crypto;
+    constructor(db, crypto) {
+        this.db = db;
+        this.crypto = crypto;
+    }
+    async load() {
+        const [row] = await this.db
+            .select()
+            .from(githubFacadeIdentity)
+            .where(eq(githubFacadeIdentity.id, ROW_ID))
+            .limit(1);
+        if (!row)
+            return null;
+        const crypto = this.requireCrypto();
+        return {
+            appId: row.appId,
+            clientId: row.clientId,
+            clientSecret: crypto.decrypt(row.clientSecret),
+            webhookSecret: crypto.decrypt(row.webhookSecret),
+            privateKeyPem: crypto.decrypt(row.privateKeyPem),
+            publicKeyPem: row.publicKeyPem,
+            createdAt: row.createdAt,
+            rotatedAt: row.rotatedAt,
+        };
+    }
+    async createIfAbsent(creds) {
+        await this.db
+            .insert(githubFacadeIdentity)
+            .values({ id: ROW_ID, ...this.seal(creds) })
+            .onConflictDoNothing({ target: githubFacadeIdentity.id });
+        return this.stored('insert');
+    }
+    async replaceIfCurrent(expectedClientId, creds) {
+        await this.db
+            .update(githubFacadeIdentity)
+            .set(this.seal(creds))
+            .where(and(eq(githubFacadeIdentity.id, ROW_ID), eq(githubFacadeIdentity.clientId, expectedClientId)));
+        return this.stored('replace');
+    }
+    async registeredAt() {
+        const [row] = await this.db
+            .select({ registeredAt: githubFacadeIdentity.registeredAt })
+            .from(githubFacadeIdentity)
+            .where(eq(githubFacadeIdentity.id, ROW_ID))
+            .limit(1);
+        return row?.registeredAt ?? null;
+    }
+    async setRegisteredAt(at) {
+        await this.db
+            .update(githubFacadeIdentity)
+            .set({ registeredAt: at })
+            .where(eq(githubFacadeIdentity.id, ROW_ID));
+    }
+    async stored(after) {
+        const row = await this.load();
+        if (!row)
+            throw new Error(`claude bridge credentials vanished between ${after} and read`);
+        return row;
+    }
+    seal(creds) {
+        const crypto = this.requireCrypto();
+        return {
+            appId: creds.appId,
+            clientId: creds.clientId,
+            clientSecret: crypto.encrypt(creds.clientSecret),
+            webhookSecret: crypto.encrypt(creds.webhookSecret),
+            privateKeyPem: crypto.encrypt(creds.privateKeyPem),
+            publicKeyPem: creds.publicKeyPem,
+            createdAt: creds.createdAt,
+            rotatedAt: creds.rotatedAt,
+        };
+    }
+    requireCrypto() {
+        if (!this.crypto) {
+            throw new GitHubFacadeUnavailableError('SECRETS_ENC_KEY is not set, so the Claude connection credentials cannot be stored.');
+        }
+        return this.crypto;
+    }
+}
+export class GitHubFacadeUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitHubFacadeUnavailableError';
+    }
+}
+/**
+ * Generates the credentials on first use and reads them from the store on
+ * every use after that. No in-process copy: the store is the one place the
+ * truth lives, whichever replica asks.
+ */
+export class GitHubFacadeCredentialsService {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    /** The credentials, generated on first use. */
+    async ensure() {
+        const existing = await this.store.load();
+        if (existing)
+            return existing;
+        return this.store.createIfAbsent(generateCredentials(null));
+    }
+    /**
+     * New credentials, all of them — replacing the set this call read, and
+     * returning whatever is stored afterwards. Every registration on the
+     * Claude side stops matching at once, which is the point of rotating: the
+     * Owner re-enters the new set, and connected users' tokens (connection
+     * keys) are untouched, since those are ours.
+     */
+    async rotate() {
+        const current = await this.ensure();
+        return this.store.replaceIfCurrent(current.clientId, generateCredentials(current.createdAt));
+    }
+    /**
+     * Whether an admin has said this deployment is registered with their Claude
+     * organization. A boolean and nothing else — this is what every signed-in
+     * person may learn, so the External agent access page can tell them whether
+     * the Cowork route is open yet. No row yet means nobody has even seen the
+     * credentials, so it cannot be registered.
+     */
+    async isRegistered() {
+        return (await this.store.registeredAt()) !== null;
+    }
+    /**
+     * Mark the deployment registered (or not). Rotation leaves this alone: it
+     * says the Claude side needs the new values, which is the rotate dialog's
+     * job to tell the admin, not a reason to hide the tutorial from everyone.
+     */
+    async setRegistered(registered) {
+        // The row must exist to carry the flag; registering credentials nobody
+        // generated would describe a registration that cannot have happened.
+        if (registered)
+            await this.ensure();
+        await this.store.setRegisteredAt(registered ? new Date() : null);
+        return this.isRegistered();
+    }
+}
+function generateCredentials(createdAt) {
+    // The shapes GitHub uses, because the form was built for them: a numeric
+    // app id, an `Iv1.`-prefixed client id, hex secrets, a PKCS#1 RSA key.
+    const { privateKey, publicKey } = generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+    });
+    return {
+        appId: String(randomInt(100_000, 999_999)),
+        clientId: `Iv1.${randomBytes(8).toString('hex')}`,
+        clientSecret: randomBytes(20).toString('hex'),
+        webhookSecret: randomBytes(16).toString('hex'),
+        privateKeyPem: privateKey,
+        publicKeyPem: publicKey,
+        createdAt: createdAt ?? new Date(),
+        rotatedAt: createdAt ? new Date() : null,
+    };
+}
+/** For tests: the row kept in memory, with the same conditional writes. */
+export class MemoryGitHubFacadeCredentialsStore {
+    row = null;
+    registered = null;
+    async load() {
+        return this.row;
+    }
+    async registeredAt() {
+        return this.row ? this.registered : null;
+    }
+    async setRegisteredAt(at) {
+        if (this.row)
+            this.registered = at;
+    }
+    async createIfAbsent(creds) {
+        this.row ??= creds;
+        return this.row;
+    }
+    async replaceIfCurrent(expectedClientId, creds) {
+        if (this.row?.clientId === expectedClientId)
+            this.row = creds;
+        return this.row;
+    }
+}
+//# sourceMappingURL=github-facade-credentials.service.js.map

package/dist/modules/marketplace/github-facade/github-facade-credentials.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade-credentials.service.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade-credentials.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAgEhE,MAAM,MAAM,GAAG,SAAS,CAAC;AAEzB;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAEtB;IACA;IAFnB,YACmB,EAAY,EACZ,MAA0B;QAD1B,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAC9C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAChD,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAChD,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA8B;QACjD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,oBAAoB,CAAC;aAC5B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;aAC3C,mBAAmB,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,gBAAwB,EAAE,KAA8B;QAC7E,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,oBAAoB,CAAC;aAC5B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,EAAE,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,CAAC;aAC3D,IAAI,CAAC,oBAAoB,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAe;QACnC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,oBAAoB,CAAC;aAC5B,GAAG,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;aACzB,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,WAAW,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,IAAI,CAAC,KAA8B;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YAChD,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YAClD,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YAClD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CACpC,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IACZ;IAA7B,YAA6B,KAAmC;QAAnC,UAAK,GAAL,KAAK,CAA8B;IAAG,CAAC;IAEpE,+CAA+C;IAC/C,KAAK,CAAC,MAAM;QACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY;QAChB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,IAAI,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,UAAmB;QACrC,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,SAAsB;IACjD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC3D,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,QAAQ,EAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACjD,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7C,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,aAAa,EAAE,UAAU;QACzB,YAAY,EAAE,SAAS;QACvB,SAAS,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE;QAClC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KACzC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,kCAAkC;IACrC,GAAG,GAAmC,IAAI,CAAC;IAC3C,UAAU,GAAgB,IAAI,CAAC;IACvC,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,EAAe;QACnC,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,KAA8B;QACjD,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,gBAAwB,EAAE,KAA8B;QAC7E,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,KAAK,gBAAgB;YAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/modules/marketplace/github-facade/github-facade.routes.d.ts

@@ -0,0 +1,47 @@
+import express from 'express';
+import '../../auth/auth.middleware.js';
+import '../../tool-auth/external-api-key.interface.js';
+import type { MarketplaceRepoService } from '../marketplace-repo.service.js';
+import type { MarketplaceKeyResolver } from '../git-http.routes.js';
+import { type GitHubFacade } from './github-facade.service.js';
+export interface GitHubFacadeRoutesDeps {
+    facade: GitHubFacade;
+    keys: MarketplaceKeyResolver;
+    repo: MarketplaceRepoService;
+    /**
+     * The owner and name claude.ai derives from the marketplace URL people
+     * paste — the SAME URL Claude Code clones: `https://<host>/git/marketplace.git`
+     * reads as owner `git`, repository `marketplace`. One address for every
+     * Claude surface.
+     */
+    owner: string;
+    repoName: string;
+    /**
+     * The deployment's public address. Only its ORIGIN is ever emitted: a
+     * configured URL may carry userinfo or a path, and neither belongs in a
+     * body handed to a third party.
+     */
+    publicUrl: string;
+}
+/**
+ * The GitHub Enterprise surface a consumer (claude.ai, Cowork) talks to when
+ * a person adds this deployment's marketplace from their own settings —
+ * observed call for call against a lookalike host, and nothing beyond it:
+ *
+ *   GET  /login/oauth/authorize        the "connect your account" redirect
+ *   POST /login/oauth/access_token     code → token (our client id + secret)
+ *   GET  /api/v3/repos/:owner/:repo    repository metadata
+ *   GET  …/commits?per_page=1          the head commit — of THIS person's tree
+ *   GET  …/zipball/:ref                that tree, zipped
+ *
+ * Mounted at the app root, ahead of the SPA and the `/api` JWT mounts: the
+ * first two are hit by a bare browser and by Anthropic's backend, the rest
+ * carry the person's token as a Bearer. The token is a connection key, so a
+ * revoked link fails here the same way it fails on the git remote.
+ *
+ * Errors are GitHub-shaped too (`{ message }`, and the OAuth error body on
+ * the token endpoint, in whichever encoding the client negotiated): the
+ * caller is a GitHub client and reads them as one.
+ */
+export declare function createGitHubFacadeRoutes(deps: GitHubFacadeRoutesDeps): express.Router;
+//# sourceMappingURL=github-facade.routes.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade.routes.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAK9B,OAAO,+BAA+B,CAAC;AACvC,OAAO,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAGzF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,sBAAsB,CAAC;IAC7B,IAAI,EAAE,sBAAsB,CAAC;IAC7B;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAgJrF"}

package/dist/modules/marketplace/github-facade/github-facade.routes.js

@@ -0,0 +1,252 @@
+import express from 'express';
+import { logger } from '../../../shared/logging.js';
+const log = logger('github-facade');
+import '../../auth/auth.middleware.js'; // Express Request.userId / userEmail augmentation
+import '../../tool-auth/external-api-key.interface.js'; // Express Request augmentation (req.externalApiKeyId)
+import { GitHubFacadeRequestError } from './github-facade.service.js';
+import { printable } from '../../../shared/printable.js';
+/**
+ * The GitHub Enterprise surface a consumer (claude.ai, Cowork) talks to when
+ * a person adds this deployment's marketplace from their own settings —
+ * observed call for call against a lookalike host, and nothing beyond it:
+ *
+ *   GET  /login/oauth/authorize        the "connect your account" redirect
+ *   POST /login/oauth/access_token     code → token (our client id + secret)
+ *   GET  /api/v3/repos/:owner/:repo    repository metadata
+ *   GET  …/commits?per_page=1          the head commit — of THIS person's tree
+ *   GET  …/zipball/:ref                that tree, zipped
+ *
+ * Mounted at the app root, ahead of the SPA and the `/api` JWT mounts: the
+ * first two are hit by a bare browser and by Anthropic's backend, the rest
+ * carry the person's token as a Bearer. The token is a connection key, so a
+ * revoked link fails here the same way it fails on the git remote.
+ *
+ * Errors are GitHub-shaped too (`{ message }`, and the OAuth error body on
+ * the token endpoint, in whichever encoding the client negotiated): the
+ * caller is a GitHub client and reads them as one.
+ */
+export function createGitHubFacadeRoutes(deps) {
+    const router = express.Router();
+    const { facade, keys, repo, owner, repoName } = deps;
+    const origin = new URL(deps.publicUrl).origin;
+    const fullName = `${owner}/${repoName}`;
+    // Every refusal on the connect flow is logged with its reason: the
+    // consumer's backend swallows our answer, so a person who "connected and
+    // came back to Claude" with nothing to show for it has only this log to
+    // say which hop failed. Reasons name a check, never a secret or a code;
+    // what the caller sent (its user agent) is rendered printable, so the
+    // caller cannot write a line of its own.
+    const refused = (req, hop, err) => {
+        log.warn(`${hop} refused (${err.status} ${err.code}): ${err.detail} — from ${userAgentOf(req)}`);
+    };
+    router.get('/login/oauth/authorize', async (req, res) => {
+        try {
+            res.redirect(302, await facade.authorizeRedirect(req.query));
+        }
+        catch (err) {
+            if (err instanceof GitHubFacadeRequestError)
+                refused(req, 'authorize', err);
+            answerError(res, err);
+        }
+    });
+    // GitHub's token endpoint takes JSON or a form and answers in the shape
+    // `Accept` asks for — success and failure alike; claude.ai sends JSON and
+    // asks for JSON.
+    router.post('/login/oauth/access_token', express.json({ limit: '16kb' }), express.urlencoded({ extended: false, limit: '16kb' }), async (req, res) => {
+        try {
+            negotiated(req, res, 200, await facade.exchangeCode((req.body ?? {})));
+        }
+        catch (err) {
+            if (err instanceof GitHubFacadeRequestError) {
+                refused(req, 'token exchange', err);
+                negotiated(req, res, err.status, { error: err.code, error_description: err.message });
+                return;
+            }
+            answerError(res, err);
+        }
+    });
+    // --- the REST API, as far as the observed contract goes ---------------------
+    const api = express.Router();
+    api.use(async (req, res, next) => {
+        const token = bearerOf(req);
+        if (!token || !keys.looksLikeExternalApiKey(token)) {
+            unauthorized(req, res, token ? 'bearer is not a connection key' : 'no bearer');
+            return;
+        }
+        let resolved;
+        try {
+            resolved = await keys.verifyAndLoadToken(token);
+        }
+        catch (err) {
+            log.error('key verification failed:', { err });
+            res.status(500).json({ message: 'Authentication backend unavailable' });
+            return;
+        }
+        if (!resolved) {
+            unauthorized(req, res, 'connection key unknown or revoked');
+            return;
+        }
+        req.userId = resolved.user.id;
+        req.userEmail = resolved.user.email;
+        req.externalApiKeyId = resolved.tokenId;
+        next();
+    });
+    const isOurs = (req) => req.params.owner === owner && req.params.repo === repoName;
+    const notFound = (res) => res.status(404).json({ message: 'Not Found' });
+    api.get('/repos/:owner/:repo', (req, res) => {
+        if (!isOurs(req))
+            return void notFound(res);
+        res.json(repositoryBody(fullName, owner, repoName, origin));
+    });
+    api.get('/repos/:owner/:repo/commits', async (req, res) => {
+        if (!isOurs(req))
+            return void notFound(res);
+        try {
+            const { sha } = await repo.headFor({ id: req.userId, email: req.userEmail });
+            const commit = await repo.describeCommit(sha);
+            res.json([commitBody(commit, fullName, origin)]);
+        }
+        catch (err) {
+            answerError(res, err);
+        }
+    });
+    api.get('/repos/:owner/:repo/zipball/:ref', async (req, res) => {
+        if (!isOurs(req))
+            return void notFound(res);
+        try {
+            const { namespace, sha: head } = await repo.headFor({ id: req.userId, email: req.userEmail });
+            const ref = req.params.ref;
+            // Only THIS person's tree, at its head or a commit behind it: the object
+            // store is shared across everyone, so a sha alone must never be enough
+            // to read a tree compiled for someone else.
+            const sha = ref === 'HEAD' || ref === 'main' ? head : ref;
+            if (!(await repo.contains(namespace, sha)))
+                return void notFound(res);
+            res.status(200);
+            res.setHeader('Content-Type', 'application/zip');
+            res.setHeader('Content-Disposition', `attachment; filename=${owner}-${repoName}-${sha.slice(0, 7)}.zip`);
+            const archive = repo.archiveZip(sha, `${owner}-${repoName}-${sha.slice(0, 7)}`);
+            const stderr = [];
+            archive.stderr?.on('data', (chunk) => stderr.push(chunk));
+            const fail = (reason) => {
+                log.error(`zipball ${sha.slice(0, 7)} failed: ${reason}`);
+                // Headers are already out once the stream started; the only honest
+                // answer then is a cut connection, which the client sees as a failed
+                // download rather than a truncated archive it might unpack.
+                if (!res.headersSent)
+                    res.status(500).json({ message: 'Archive failed' });
+                else
+                    res.destroy();
+            };
+            archive.on('error', (err) => fail(err.message));
+            // A client that goes away mid-download must not leave git running —
+            // and that kill is the ONE signal exit that is not a failure: git dying
+            // to any other signal left a truncated archive on the wire.
+            let stopped = false;
+            const stop = () => {
+                if (archive.exitCode === null && !archive.killed) {
+                    stopped = true;
+                    archive.kill();
+                }
+            };
+            archive.on('close', (code, signal) => {
+                if (code === 0 || stopped)
+                    return;
+                fail(`git archive exited ${code ?? `on ${signal}`}: ${Buffer.concat(stderr).toString().trim()}`);
+            });
+            req.on('aborted', stop);
+            res.on('close', stop);
+            archive.stdout.pipe(res);
+        }
+        catch (err) {
+            answerError(res, err);
+        }
+    });
+    api.use((_req, res) => notFound(res));
+    router.use('/api/v3', api);
+    return router;
+}
+function bearerOf(req) {
+    const header = req.headers.authorization;
+    if (!header)
+        return null;
+    const [scheme, ...rest] = header.split(' ');
+    if (!scheme || !/^(bearer|token)$/i.test(scheme))
+        return null;
+    return rest.join(' ').trim() || null;
+}
+/** GitHub's 401 — and a log line saying why, since the consumer's backend will not. */
+function unauthorized(req, res, why) {
+    // The PATH, never the full URL: a query string is the caller's to fill,
+    // and a credential put there would otherwise land in the log.
+    log.warn(`${req.method} ${printable(req.path)} refused: ${why} — from ${userAgentOf(req)}`);
+    res.setHeader('WWW-Authenticate', 'Bearer realm="hexis-marketplace"');
+    res.status(401).json({ message: 'Bad credentials' });
+}
+/** The caller's user agent as one printable token — it is theirs to fill with anything. */
+function userAgentOf(req) {
+    const ua = req.headers['user-agent'];
+    return ua ? printable(ua) : 'no user-agent';
+}
+/** The token endpoint's reply, in the encoding the client asked for. */
+function negotiated(req, res, status, payload) {
+    const accept = req.headers.accept ?? '';
+    const wantsForm = accept.includes('application/x-www-form-urlencoded') && !accept.includes('json');
+    res.status(status);
+    if (wantsForm) {
+        res.type('application/x-www-form-urlencoded').send(new URLSearchParams(payload).toString());
+        return;
+    }
+    res.json(payload);
+}
+function answerError(res, err) {
+    if (err instanceof GitHubFacadeRequestError) {
+        res.status(err.status).json({ message: err.message });
+        return;
+    }
+    log.error('request failed:', { err });
+    res.status(500).json({ message: 'Internal error' });
+}
+/** A repository as GitHub describes one — the fields a marketplace sync reads. */
+function repositoryBody(fullName, owner, name, origin) {
+    const html = `${origin}/${fullName}`;
+    return {
+        id: 1,
+        node_id: 'R_hexis_marketplace',
+        name,
+        full_name: fullName,
+        private: true,
+        owner: { login: owner, id: 1, type: 'Organization' },
+        html_url: html,
+        description: 'The skills you may read, compiled as native plugins.',
+        fork: false,
+        url: `${origin}/api/v3/repos/${fullName}`,
+        clone_url: `${html}.git`,
+        default_branch: 'main',
+        visibility: 'private',
+        archived: false,
+        disabled: false,
+        permissions: { admin: false, maintain: false, push: false, triage: false, pull: true },
+    };
+}
+function commitBody(commit, fullName, origin) {
+    const base = `${origin}/api/v3/repos/${fullName}`;
+    const who = { name: commit.authorName, email: commit.authorEmail, date: commit.date };
+    return {
+        sha: commit.sha,
+        node_id: `C_${commit.sha}`,
+        commit: {
+            author: who,
+            committer: who,
+            message: commit.message,
+            tree: { sha: commit.tree, url: `${base}/git/trees/${commit.tree}` },
+            comment_count: 0,
+        },
+        url: `${base}/commits/${commit.sha}`,
+        html_url: `${origin}/${fullName}/commit/${commit.sha}`,
+        author: null,
+        committer: null,
+        parents: [],
+    };
+}
+//# sourceMappingURL=github-facade.routes.js.map

package/dist/modules/marketplace/github-facade/github-facade.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade.routes.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AAEpC,OAAO,+BAA+B,CAAC,CAAC,kDAAkD;AAC1F,OAAO,+CAA+C,CAAC,CAAC,sDAAsD;AAG9G,OAAO,EAAE,wBAAwB,EAAqB,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAsBzD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC;IAExC,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,GAAW,EAAE,GAA6B,EAAE,EAAE;QACnF,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,WAAW,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAgC,CAAC,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB;gBAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAC5E,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,0EAA0E;IAC1E,iBAAiB;IACjB,MAAM,CAAC,IAAI,CACT,2BAA2B,EAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAC/B,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EACtD,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;gBACpC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,+EAA+E;IAE/E,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAE7B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,QAAoD,CAAC;QACzD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;QACxC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;IACpG,MAAM,QAAQ,GAAG,CAAC,GAAqB,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAE3F,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAO,EAAE,KAAK,EAAE,GAAG,CAAC,SAAU,EAAE,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAO,EAAE,KAAK,EAAE,GAAG,CAAC,SAAU,EAAE,CAAC,CAAC;YAChG,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3B,yEAAyE;YACzE,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,wBAAwB,KAAK,IAAI,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACzG,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAChF,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE;gBAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;gBAC1D,mEAAmE;gBACnE,qEAAqE;gBACrE,4DAA4D;gBAC5D,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;;oBACrE,GAAG,CAAC,OAAO,EAAE,CAAC;YACrB,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACvD,oEAAoE;YACpE,wEAAwE;YACxE,4DAA4D;YAC5D,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACjD,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACnC,IAAI,IAAI,KAAK,CAAC,IAAI,OAAO;oBAAE,OAAO;gBAClC,IAAI,CAAC,sBAAsB,IAAI,IAAI,MAAM,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtB,OAAO,CAAC,MAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAE3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,GAAoB,EAAE,GAAqB,EAAE,GAAW;IAC5E,wEAAwE;IACxE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,WAAW,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;IACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,2FAA2F;AAC3F,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC9C,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CACjB,GAAoB,EACpB,GAAqB,EACrB,MAAc,EACd,OAA+B;IAE/B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB,EAAE,GAAY;IACtD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa,EAAE,IAAY,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;IACrC,OAAO;QACL,EAAE,EAAE,CAAC;QACL,OAAO,EAAE,qBAAqB;QAC9B,IAAI;QACJ,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;QACpD,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,sDAAsD;QACnE,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,GAAG,MAAM,iBAAiB,QAAQ,EAAE;QACzC,SAAS,EAAE,GAAG,IAAI,MAAM;QACxB,cAAc,EAAE,MAAM;QACtB,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;KACvF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,MAA6G,EAC7G,QAAgB,EAChB,MAAc;IAEd,MAAM,IAAI,GAAG,GAAG,MAAM,iBAAiB,QAAQ,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACtF,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE;QAC1B,MAAM,EAAE;YACN,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,cAAc,MAAM,CAAC,IAAI,EAAE,EAAE;YACnE,aAAa,EAAE,CAAC;SACjB;QACD,GAAG,EAAE,GAAG,IAAI,YAAY,MAAM,CAAC,GAAG,EAAE;QACpC,QAAQ,EAAE,GAAG,MAAM,IAAI,QAAQ,WAAW,MAAM,CAAC,GAAG,EAAE;QACtD,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/modules/marketplace/github-facade/github-facade.service.d.ts

@@ -0,0 +1,121 @@
+import type { KeyKindSpec, MintedExternalApiKey } from '../../tool-auth/external-api-key.interface.js';
+import { type McpAuthRequestState } from '../../mcp/oauth/oauth-state.js';
+import type { GitHubFacadeCredentialsService } from './github-facade-credentials.service.js';
+import type { GitHubFacadeCodeStore } from './github-facade-codes.store.js';
+/**
+ * The KIND stored on a connection key minted through the facade, and how
+ * that kind is spelled. `gho_` plus forty letters and digits is what a
+ * GitHub OAuth token looks like — the shape a consumer expecting a GitHub
+ * Enterprise host accepts, and may well check; the key is otherwise an
+ * ordinary connection key — hashed at rest, revocable from the person's
+ * external-agent page, accepted by every surface a connection key is. The
+ * kind, not the label, is what tells such a key apart: a label is the
+ * person's to edit.
+ */
+export declare const GITHUB_LINK_KEY_KIND = "github-link";
+export declare const GITHUB_LINK_KEY_PREFIX = "gho_";
+export declare const GITHUB_LINK_KEY_SPEC: KeyKindSpec;
+/**
+ * A product that talks to this deployment as if it were a GitHub Enterprise
+ * Server. The facade itself is consumer-neutral — GitHub's OAuth pair and
+ * REST subset are the contract — and a consumer is the one thing that is not:
+ * where its callback lives (the only place a code may be sent), what the
+ * consent page calls it, and how the keys it holds are labelled for the
+ * person. Claude is the first; another product with a "connect your GitHub
+ * Enterprise" flow is one more entry, not one more module.
+ */
+export interface GitHubFacadeConsumer {
+    id: string;
+    /** What the consent page says is asking. */
+    name: string;
+    /** Hostnames a redirect_uri may point at. */
+    redirectHosts: readonly string[];
+    /** The label on the connection keys minted for this consumer. */
+    keyLabel: string;
+}
+/** claude.ai and Cowork: the consumer this facade was built against. */
+export declare const CLAUDE_CONSUMER: GitHubFacadeConsumer;
+export interface GitHubFacadeKeyMinter {
+    mint(userId: string, label: string, options?: {
+        kind?: string;
+    }): Promise<MintedExternalApiKey>;
+}
+export interface GitHubFacadeDeps {
+    credentials: GitHubFacadeCredentialsService;
+    codes: GitHubFacadeCodeStore;
+    keys: GitHubFacadeKeyMinter;
+    /** Who may connect through the facade. */
+    consumers: readonly GitHubFacadeConsumer[];
+    /** HMAC secret for the signed authorize state — the same one the MCP flow uses. */
+    stateSecret: string;
+    /** SPA base URL — where the browser is sent to sign in and approve. */
+    publicFrontendUrl: string;
+}
+/**
+ * A refusal the caller is answered with in GitHub's terms — and, for the
+ * server log only, WHY: `detail` names the check that failed (a client
+ * secret that is not the registered one, a code nobody issued) where the
+ * response deliberately says no more than GitHub would. A consumer's
+ * backend never shows its user what we answered; the log is the only place
+ * an operator can see which hop of the connect flow went wrong. It never
+ * carries a secret or a code.
+ */
+export declare class GitHubFacadeRequestError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly detail: string;
+    constructor(status: number, code: string, message: string, detail?: string);
+}
+/**
+ * The "connect your GitHub Enterprise account" flow, as a consumer such as claude.ai drives it
+ * against a GitHub Enterprise host — with hexis standing where GitHub would.
+ *
+ *   1. The browser lands on `/login/oauth/authorize?client_id&redirect_uri&state`.
+ *      We check the client id is ours and the redirect goes to claude.ai,
+ *      pack the request into the SAME signed state the MCP authorization
+ *      flow uses, and send the browser to the SPA's `/connect` page — where a
+ *      hexis session (or a sign-in) attaches a person to the request.
+ *   2. Finish on that page comes back through the consent routes with the
+ *      state; {@link completeConsent} stores a one-time code bound to that
+ *      person and returns the callback URL carrying it.
+ *   3. Anthropic's backend posts the code with our client id and secret to
+ *      `/login/oauth/access_token`; {@link exchangeCode} turns it into a
+ *      connection key for that person — the token every later fetch carries.
+ *
+ * Nothing here is remembered in the process: credentials and codes are read
+ * from their stores on every step, so the replica that issued a code and the
+ * replica that exchanges it need not be the same one.
+ */
+export declare class GitHubFacade {
+    private readonly deps;
+    constructor(deps: GitHubFacadeDeps);
+    /** Where to send the browser for an authorize request, or a 4xx to answer with. */
+    authorizeRedirect(query: Record<string, unknown>): Promise<string>;
+    /** True when a verified state is one of ours (a GitHub-shaped link, not an MCP client). */
+    isFacadeRequest(st: McpAuthRequestState): boolean;
+    /** What the consent page should say is asking, for one of our states. */
+    clientNameFor(st: McpAuthRequestState): string;
+    /**
+     * The person approved on `/connect`: a one-time code for them, and the
+     * claude.ai callback to send the browser to. Supersedes any live code the
+     * same person already had for this client.
+     */
+    completeConsent(userId: string, st: McpAuthRequestState): Promise<{
+        redirectTo: string;
+    }>;
+    /**
+     * The token exchange. Client id and secret must be ours and the code live;
+     * every check runs BEFORE the code is spent, so a request that is wrong
+     * about something else (its redirect, say) can be corrected and retried.
+     * Spending is one conditional update in the store — the first exchange
+     * wins, on whichever replica, and only the winner mints.
+     */
+    exchangeCode(body: Record<string, unknown>): Promise<{
+        access_token: string;
+        token_type: 'bearer';
+        scope: '';
+    }>;
+    /** The consumer whose callback a redirect_uri is, or null — https only, host exactly. */
+    private consumerFor;
+}
+//# sourceMappingURL=github-facade.service.d.ts.map

package/dist/modules/marketplace/github-facade/github-facade.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade.service.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade.service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAC7F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAG5E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAClD,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,oBAAoB,EAAE,WAAuE,CAAC;AAE3G;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wEAAwE;AACxE,eAAO,MAAM,eAAe,EAAE,oBAK7B,CAAC;AAKF,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACjG;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,8BAA8B,CAAC;IAC5C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,0CAA0C;IAC1C,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAE/C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAHd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,MAAM,GAAE,MAAgB;CAKpC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,gBAAgB;IAEnD,mFAAmF;IAC7E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAgCxE,2FAA2F;IAC3F,eAAe,CAAC,EAAE,EAAE,mBAAmB,GAAG,OAAO;IAIjD,yEAAyE;IACzE,aAAa,CAAC,EAAE,EAAE,mBAAmB,GAAG,MAAM;IAI9C;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB/F;;;;;;OAMG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC;QACrB,KAAK,EAAE,EAAE,CAAC;KACX,CAAC;IAiDF,yFAAyF;IACzF,OAAO,CAAC,WAAW;CAUpB"}