@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/marketplace/github-facade/github-facade.service.js

@@ -0,0 +1,213 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { logger } from '../../../shared/logging.js';
+const log = logger('github-facade');
+import { signAuthRequest } from '../../mcp/oauth/oauth-state.js';
+import { printable } from '../../../shared/printable.js';
+/**
+ * The KIND stored on a connection key minted through the facade, and how
+ * that kind is spelled. `gho_` plus forty letters and digits is what a
+ * GitHub OAuth token looks like — the shape a consumer expecting a GitHub
+ * Enterprise host accepts, and may well check; the key is otherwise an
+ * ordinary connection key — hashed at rest, revocable from the person's
+ * external-agent page, accepted by every surface a connection key is. The
+ * kind, not the label, is what tells such a key apart: a label is the
+ * person's to edit.
+ */
+export const GITHUB_LINK_KEY_KIND = 'github-link';
+export const GITHUB_LINK_KEY_PREFIX = 'gho_';
+export const GITHUB_LINK_KEY_SPEC = { prefix: GITHUB_LINK_KEY_PREFIX, shape: 'github-token' };
+/** claude.ai and Cowork: the consumer this facade was built against. */
+export const CLAUDE_CONSUMER = {
+    id: 'claude',
+    name: 'Claude',
+    redirectHosts: ['claude.ai'],
+    keyLabel: 'Claude (claude.ai and Cowork)',
+};
+const CODE_TTL_MS = 10 * 60_000;
+const CODE_BYTES = 10;
+/**
+ * A refusal the caller is answered with in GitHub's terms — and, for the
+ * server log only, WHY: `detail` names the check that failed (a client
+ * secret that is not the registered one, a code nobody issued) where the
+ * response deliberately says no more than GitHub would. A consumer's
+ * backend never shows its user what we answered; the log is the only place
+ * an operator can see which hop of the connect flow went wrong. It never
+ * carries a secret or a code.
+ */
+export class GitHubFacadeRequestError extends Error {
+    status;
+    code;
+    detail;
+    constructor(status, code, message, detail = message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.detail = detail;
+        this.name = 'GitHubFacadeRequestError';
+    }
+}
+/**
+ * The "connect your GitHub Enterprise account" flow, as a consumer such as claude.ai drives it
+ * against a GitHub Enterprise host — with hexis standing where GitHub would.
+ *
+ *   1. The browser lands on `/login/oauth/authorize?client_id&redirect_uri&state`.
+ *      We check the client id is ours and the redirect goes to claude.ai,
+ *      pack the request into the SAME signed state the MCP authorization
+ *      flow uses, and send the browser to the SPA's `/connect` page — where a
+ *      hexis session (or a sign-in) attaches a person to the request.
+ *   2. Finish on that page comes back through the consent routes with the
+ *      state; {@link completeConsent} stores a one-time code bound to that
+ *      person and returns the callback URL carrying it.
+ *   3. Anthropic's backend posts the code with our client id and secret to
+ *      `/login/oauth/access_token`; {@link exchangeCode} turns it into a
+ *      connection key for that person — the token every later fetch carries.
+ *
+ * Nothing here is remembered in the process: credentials and codes are read
+ * from their stores on every step, so the replica that issued a code and the
+ * replica that exchanges it need not be the same one.
+ */
+export class GitHubFacade {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Where to send the browser for an authorize request, or a 4xx to answer with. */
+    async authorizeRedirect(query) {
+        const clientId = str(query.client_id);
+        const redirectUri = str(query.redirect_uri);
+        const state = str(query.state);
+        const creds = await this.deps.credentials.ensure();
+        if (!clientId || !safeEqual(clientId, creds.clientId)) {
+            throw new GitHubFacadeRequestError(400, 'unknown_client', 'Unknown client_id.', clientId ? 'client_id is not the registered one (rotated since, or mistyped)' : 'no client_id in the request');
+        }
+        if (!this.consumerFor(redirectUri)) {
+            throw new GitHubFacadeRequestError(400, 'invalid_redirect', 'redirect_uri does not belong to a known consumer.', `redirect_uri host is ${hostOf(redirectUri)}, not a consumer's`);
+        }
+        const signed = signAuthRequest(this.deps.stateSecret, {
+            c: clientId,
+            r: redirectUri,
+            s: state || undefined,
+            gh: true,
+        });
+        const url = new URL('/connect', this.deps.publicFrontendUrl);
+        url.searchParams.set('oauth', signed);
+        return url.toString();
+    }
+    /** True when a verified state is one of ours (a GitHub-shaped link, not an MCP client). */
+    isFacadeRequest(st) {
+        return st.gh === true;
+    }
+    /** What the consent page should say is asking, for one of our states. */
+    clientNameFor(st) {
+        return this.consumerFor(st.r)?.name ?? 'an external product';
+    }
+    /**
+     * The person approved on `/connect`: a one-time code for them, and the
+     * claude.ai callback to send the browser to. Supersedes any live code the
+     * same person already had for this client.
+     */
+    async completeConsent(userId, st) {
+        const creds = await this.deps.credentials.ensure();
+        if (!safeEqual(st.c, creds.clientId) || !this.consumerFor(st.r)) {
+            throw new GitHubFacadeRequestError(400, 'invalid_request', 'The authorization request is not one of ours.');
+        }
+        const code = randomBytes(CODE_BYTES).toString('hex');
+        await this.deps.codes.put({
+            codeHash: hashCode(code),
+            userId,
+            clientId: st.c,
+            redirectUri: st.r,
+            expiresAt: new Date(Date.now() + CODE_TTL_MS),
+        });
+        const url = new URL(st.r);
+        url.searchParams.set('code', code);
+        if (st.s)
+            url.searchParams.set('state', st.s);
+        return { redirectTo: url.toString() };
+    }
+    /**
+     * The token exchange. Client id and secret must be ours and the code live;
+     * every check runs BEFORE the code is spent, so a request that is wrong
+     * about something else (its redirect, say) can be corrected and retried.
+     * Spending is one conditional update in the store — the first exchange
+     * wins, on whichever replica, and only the winner mints.
+     */
+    async exchangeCode(body) {
+        const creds = await this.deps.credentials.ensure();
+        const clientId = str(body.client_id);
+        const clientSecret = str(body.client_secret);
+        const code = str(body.code);
+        // One answer for every credential failure, as GitHub gives; the log
+        // alone says which half was wrong.
+        const credentialsWrong = (detail) => new GitHubFacadeRequestError(401, 'incorrect_client_credentials', 'The client_id and/or client_secret passed are incorrect.', detail);
+        if (!clientId || !safeEqual(clientId, creds.clientId)) {
+            throw credentialsWrong(clientId ? 'client_id is not the registered one (rotated since, or mistyped)' : 'no client_id in the request');
+        }
+        if (!clientSecret || !safeEqual(clientSecret, creds.clientSecret)) {
+            throw credentialsWrong(clientSecret ? 'client_secret is not the registered one (rotated since, or mistyped)' : 'no client_secret in the request');
+        }
+        const codeWrong = (detail) => new GitHubFacadeRequestError(400, 'bad_verification_code', 'The code passed is incorrect or expired.', detail);
+        if (!code)
+            throw codeWrong('no code in the request');
+        const pending = await this.deps.codes.peek(hashCode(code));
+        if (!pending)
+            throw codeWrong('no live code with that value: never issued, already spent, or older than 10 minutes');
+        if (pending.clientId !== clientId)
+            throw codeWrong('the code was issued under a different client id');
+        const redirectUri = str(body.redirect_uri);
+        if (redirectUri && redirectUri !== pending.redirectUri) {
+            throw new GitHubFacadeRequestError(400, 'redirect_uri_mismatch', 'The redirect_uri does not match the authorization.', `redirect_uri host is ${hostOf(redirectUri)}, the code was issued for ${hostOf(pending.redirectUri)}`);
+        }
+        const spent = await this.deps.codes.consume(pending.codeHash);
+        if (!spent)
+            throw codeWrong('the code was spent by a concurrent exchange');
+        // The consumer is the one the code was issued for — the redirect the
+        // person approved names it — so the key is labelled for that product.
+        const consumer = this.consumerFor(spent.redirectUri);
+        const minted = await this.deps.keys.mint(spent.userId, consumer?.keyLabel ?? 'GitHub-compatible link', {
+            kind: GITHUB_LINK_KEY_KIND,
+        });
+        log.info(`${printable(consumer?.name ?? 'a consumer')} connected user ${printable(spent.userId)}: link key ${printable(minted.summary.id)} minted`);
+        return { access_token: minted.plaintext, token_type: 'bearer', scope: '' };
+    }
+    /** The consumer whose callback a redirect_uri is, or null — https only, host exactly. */
+    consumerFor(redirectUri) {
+        let parsed;
+        try {
+            parsed = new URL(redirectUri);
+        }
+        catch {
+            return null;
+        }
+        if (parsed.protocol !== 'https:')
+            return null;
+        return this.deps.consumers.find((c) => c.redirectHosts.includes(parsed.hostname)) ?? null;
+    }
+}
+function hashCode(code) {
+    return createHash('sha256').update(code).digest('hex');
+}
+/**
+ * The host of a URL for a log line, or what was sent when it is not one.
+ * The caller chose the URL, so the host is rendered printable even though a
+ * parsed host is ASCII: the log's one-line rule holds by construction, not
+ * by an argument about URL parsing.
+ */
+function hostOf(url) {
+    try {
+        const host = new URL(url).host;
+        return host ? printable(host) : '(empty)';
+    }
+    catch {
+        return url ? '(not a URL)' : '(empty)';
+    }
+}
+function str(v) {
+    return typeof v === 'string' ? v : '';
+}
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+//# sourceMappingURL=github-facade.service.js.map

package/dist/modules/marketplace/github-facade/github-facade.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-facade.service.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/github-facade.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AAEpC,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAG3F,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAgB,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAqB3G,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,aAAa,EAAE,CAAC,WAAW,CAAC;IAC5B,QAAQ,EAAE,+BAA+B;CAC1C,CAAC;AAEF,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC;AAkBtB;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAEtC;IACA;IAEA;IAJX,YACW,MAAc,EACd,IAAY,EACrB,OAAe,EACN,SAAiB,OAAO;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAkB;QAGjC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEvD,mFAAmF;IACnF,KAAK,CAAC,iBAAiB,CAAC,KAA8B;QACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,gBAAgB,EAChB,oBAAoB,EACpB,QAAQ,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,6BAA6B,CAC9G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,kBAAkB,EAClB,mDAAmD,EACnD,wBAAwB,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACpD,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,KAAK,IAAI,SAAS;YACrB,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,2FAA2F;IAC3F,eAAe,CAAC,EAAuB;QACrC,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;IACxB,CAAC;IAED,yEAAyE;IACzE,aAAa,CAAC,EAAuB;QACnC,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,qBAAqB,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,EAAuB;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;YACxB,MAAM;YACN,QAAQ,EAAE,EAAE,CAAC,CAAC;YACd,WAAW,EAAE,EAAE,CAAC,CAAC;YACjB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,IAA6B;QAK9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,oEAAoE;QACpE,mCAAmC;QACnC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,EAAE,CAC1C,IAAI,wBAAwB,CAC1B,GAAG,EACH,8BAA8B,EAC9B,0DAA0D,EAC1D,MAAM,CACP,CAAC;QACJ,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;QACpJ,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CACnC,IAAI,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,EAAE,0CAA0C,EAAE,MAAM,CAAC,CAAC;QACjH,IAAI,CAAC,IAAI;YAAE,MAAM,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,qFAAqF,CAAC,CAAC;QACrH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACtG,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,IAAI,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACvD,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,uBAAuB,EACvB,oDAAoD,EACpD,wBAAwB,MAAM,CAAC,WAAW,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,MAAM,SAAS,CAAC,6CAA6C,CAAC,CAAC;QAC3E,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI,wBAAwB,EAAE;YACrG,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CACN,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,YAAY,CAAC,mBAAmB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAC1I,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,yFAAyF;IACjF,WAAW,CAAC,WAAmB;QACrC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5F,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/modules/marketplace/github-facade/index.d.ts

@@ -0,0 +1,6 @@
+export { GitHubFacadeCredentialsService, DbGitHubFacadeCredentialsStore, MemoryGitHubFacadeCredentialsStore, GitHubFacadeUnavailableError, type GitHubFacadeCredentials, type GitHubFacadeCredentialsStore, } from './github-facade-credentials.service.js';
+export { DbGitHubFacadeCodeStore, MemoryGitHubFacadeCodeStore, type GitHubFacadeCodeStore, type PendingFacadeCode, } from './github-facade-codes.store.js';
+export { GitHubFacade, GitHubFacadeRequestError, GITHUB_LINK_KEY_KIND, GITHUB_LINK_KEY_PREFIX, GITHUB_LINK_KEY_SPEC, CLAUDE_CONSUMER, type GitHubFacadeConsumer, type GitHubFacadeDeps, } from './github-facade.service.js';
+export { createGitHubFacadeRoutes, type GitHubFacadeRoutesDeps } from './github-facade.routes.js';
+export { createGitHubFacadeAdminRoutes, type GitHubFacadeAdminRoutesDeps } from './github-facade-admin.routes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/marketplace/github-facade/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,4BAA4B,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,GAClC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAE,KAAK,2BAA2B,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/modules/marketplace/github-facade/index.js

@@ -0,0 +1,6 @@
+export { GitHubFacadeCredentialsService, DbGitHubFacadeCredentialsStore, MemoryGitHubFacadeCredentialsStore, GitHubFacadeUnavailableError, } from './github-facade-credentials.service.js';
+export { DbGitHubFacadeCodeStore, MemoryGitHubFacadeCodeStore, } from './github-facade-codes.store.js';
+export { GitHubFacade, GitHubFacadeRequestError, GITHUB_LINK_KEY_KIND, GITHUB_LINK_KEY_PREFIX, GITHUB_LINK_KEY_SPEC, CLAUDE_CONSUMER, } from './github-facade.service.js';
+export { createGitHubFacadeRoutes } from './github-facade.routes.js';
+export { createGitHubFacadeAdminRoutes } from './github-facade-admin.routes.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/marketplace/github-facade/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/marketplace/github-facade/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,4BAA4B,GAG7B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAG5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,GAGhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAA+B,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAoC,MAAM,iCAAiC,CAAC"}

package/dist/modules/marketplace/index.d.ts

@@ -0,0 +1,4 @@
+export { MarketplaceRepoService, type MarketplaceCompiler, type EnsureResult } from './marketplace-repo.service.js';
+export { createMarketplaceGitRoutes, type MarketplaceKeyResolver } from './git-http.routes.js';
+export * from './github-facade/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/marketplace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/marketplace/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAE,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC/F,cAAc,0BAA0B,CAAC"}

package/dist/modules/marketplace/index.js

@@ -0,0 +1,4 @@
+export { MarketplaceRepoService } from './marketplace-repo.service.js';
+export { createMarketplaceGitRoutes } from './git-http.routes.js';
+export * from './github-facade/index.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/marketplace/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/marketplace/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA+C,MAAM,+BAA+B,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAA+B,MAAM,sBAAsB,CAAC;AAC/F,cAAc,0BAA0B,CAAC"}

package/dist/modules/marketplace/marketplace-repo.service.d.ts

@@ -0,0 +1,135 @@
+import { type ChildProcess } from 'node:child_process';
+import type { VirtualTree } from '../plugins/compile/compile-marketplace.js';
+import { type IGitRunner } from '../../shared/git.contract.js';
+/** What the repo service asks the compiler for — the one seam it has. */
+export interface MarketplaceCompiler {
+    sourceCommit(): Promise<string>;
+    compileFor(audience: {
+        userEmail: string;
+    }, 
+    /** The commit the tree is compiled from, when the caller already read it. */
+    sourceCommit?: string): Promise<VirtualTree & {
+        sourceCommit: string;
+    }>;
+}
+export interface EnsureResult {
+    /** The git namespace the caller's tree lives in. */
+    namespace: string;
+    /** True when a new commit was written this call. */
+    compiled: boolean;
+    sourceCommit: string;
+}
+/**
+ * ONE bare repository, ONE git namespace per caller.
+ *
+ * Every person's compiled marketplace is a branch in its own namespace
+ * (`refs/namespaces/<ns>/refs/heads/main`), which is exactly what git
+ * namespaces exist for (gitnamespaces(7)): `git http-backend` run with
+ * `GIT_NAMESPACE=<ns>` advertises only that namespace's refs, so a clone sees
+ * a repository whose `main` is their tree and nothing else — while every
+ * identical skill across callers is one blob in one object store.
+ *
+ * Freshness is LAZY and keyed on the knowledge base's default-branch commit:
+ * every input to a compile (skills, manifests, access rules, roles, groups)
+ * lives in that repository, so "same source commit" means "same answer".
+ * The last compiled source per namespace sits in a sidecar file rather than
+ * a commit trailer, so an unchanged tree costs no commit and no re-check.
+ *
+ * Each recompile appends a commit whose parent is the namespace's current
+ * head, so a client's `git pull` is always a fast-forward — including when
+ * access was withdrawn and files vanish. Writes go through git plumbing
+ * against a temporary index: no working tree of the bare repo, no checkout.
+ *
+ * Read-only by construction: `http.receivepack` is pinned off (http-backend
+ * would otherwise enable pushes for an authenticated REMOTE_USER), and the
+ * route refuses the receive-pack service before git ever sees it.
+ */
+export declare class MarketplaceRepoService {
+    /** Absolute path of the bare repository (created on first use). */
+    readonly repoDir: string;
+    private readonly compiler;
+    /** How git is run — see `shared/git.contract.ts`. */
+    private readonly gitRunner;
+    private readonly committer;
+    private readonly locks;
+    private initialised;
+    constructor(
+    /** Absolute path of the bare repository (created on first use). */
+    repoDir: string, compiler: MarketplaceCompiler, 
+    /** How git is run — see `shared/git.contract.ts`. */
+    gitRunner: IGitRunner, committer?: {
+        name: string;
+        email: string;
+    });
+    /** The directory `GIT_PROJECT_ROOT` points at, and the repo's name under it. */
+    get projectRoot(): string;
+    get repoName(): string;
+    /** The namespace for a user id — one path segment, stable, opaque. */
+    static namespaceFor(userId: string): string;
+    ensureRepo(): Promise<void>;
+    /**
+     * Bring the caller's namespace up to the knowledge base's current commit,
+     * compiling only when it moved. Serialised per namespace: two fetches
+     * arriving together compile once.
+     */
+    ensureCompiled(user: {
+        id: string;
+        email: string;
+    }): Promise<EnsureResult>;
+    /**
+     * The caller's namespace and its head commit, compiled if stale — what the
+     * GitHub-shaped REST surface (the Cowork path) reads instead of cloning.
+     */
+    headFor(user: {
+        id: string;
+        email: string;
+    }): Promise<{
+        namespace: string;
+        sha: string;
+    }>;
+    /** One commit as the REST surface describes it. */
+    describeCommit(sha: string): Promise<{
+        sha: string;
+        tree: string;
+        message: string;
+        authorName: string;
+        authorEmail: string;
+        date: string;
+    }>;
+    /**
+     * Whether `sha` is the namespace's head or one of its ancestors — the only
+     * commits a caller may read as that namespace. The object store is shared
+     * across everyone, so a sha alone is never enough.
+     */
+    contains(namespace: string, sha: string): Promise<boolean>;
+    /** The tree at `sha` as a zip stream, every path under `prefix/`. Check {@link contains} first. */
+    archiveZip(sha: string, prefix: string): ChildProcess;
+    private refOf;
+    private headOf;
+    /**
+     * Write `tree` as a commit on the namespace's branch. Materialises the
+     * virtual tree into a scratch directory, stages it into a throwaway index
+     * against the bare object store, and commits — no working tree involved.
+     * When the tree hash equals the head's, nothing is committed.
+     */
+    private commitTree;
+    /**
+     * Point the namespace's HEAD at its branch — valid before the branch
+     * exists. A read first: the symref is written only when absent or wrong,
+     * so the common path touches nothing.
+     */
+    private ensureHead;
+    private sidecarDir;
+    private readSidecar;
+    private writeSidecar;
+    /**
+     * Every command names the bare repository with `-C`, so the working
+     * directory only has to be somewhere that EXISTS: the process's own, as
+     * before. Not the repository — the first command ever run here is the `init`
+     * that creates it, and a spawn into a directory that is not there fails as
+     * `ENOENT` on git itself, which reads as git being missing. The plumbing
+     * that reads a scratch checkout passes its own `cwd`.
+     */
+    private git;
+}
+//# sourceMappingURL=marketplace-repo.service.d.ts.map

package/dist/modules/marketplace/marketplace-repo.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace-repo.service.d.ts","sourceRoot":"","sources":["../../../src/modules/marketplace/marketplace-repo.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,UAAU,CACR,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE;IAC/B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,sBAAsB;IAK/B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAT5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,WAAW,CAA8B;;IAG/C,mEAAmE;IAC1D,OAAO,EAAE,MAAM,EACP,QAAQ,EAAE,mBAAmB;IAC9C,qDAAqD;IACpC,SAAS,EAAE,UAAU,EACrB,SAAS,GAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAGxD;IAGH,gFAAgF;IAChF,IAAI,WAAW,IAAI,MAAM,CAExB;IACD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,sEAAsE;IACtE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIrC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBjC;;;;OAIG;IACG,cAAc,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAqChF;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/F,mDAAmD;IAC7C,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IAcF;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBhE,mGAAmG;IACnG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY;IASrD,OAAO,CAAC,KAAK;YAIC,MAAM;IAgBpB;;;;;OAKG;YACW,UAAU;IAoDxB;;;;OAIG;YACW,UAAU;IAUxB,OAAO,CAAC,UAAU;YAIJ,WAAW;YAQX,YAAY;IAI1B;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG;CAGZ"}