@enbox/gitd 0.0.1

package/dist/esm/git-remote/parse-url.js

@@ -0,0 +1,60 @@
+/**
+ * Parse DID URLs used with `git-remote-did`.
+ *
+ * Supported URL forms (all invoke `git-remote-did <remote> <url>`):
+ *
+ *   did::dht:abc123                → DID = did:dht:abc123, repo = undefined
+ *   did::dht:abc123/my-repo       → DID = did:dht:abc123, repo = my-repo
+ *   did://dht:abc123/my-repo      → DID = did:dht:abc123, repo = my-repo
+ *
+ * The double-colon form (`did::<address>`) is recommended because it avoids
+ * URL-parsing ambiguity.  Git strips the `did::` prefix and passes
+ * `<address>` as the URL argument.
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Parser
+// ---------------------------------------------------------------------------
+/**
+ * Parse a DID remote URL into its components.
+ *
+ * @param url - The URL argument passed by Git to the remote helper.
+ *              After stripping the transport prefix:
+ *                `did::dht:abc123/repo` → Git passes `dht:abc123/repo`
+ *                `did://dht:abc123/repo` → Git passes `did://dht:abc123/repo`
+ */
+export function parseDidUrl(url) {
+    let stripped = url;
+    // Strip did:// prefix if present (the `://` form).
+    if (stripped.startsWith('did://')) {
+        stripped = stripped.slice('did://'.length);
+    }
+    // At this point, `stripped` is either:
+    //   "dht:abc123"          (DID only)
+    //   "dht:abc123/my-repo"  (DID + repo path)
+    //   "web:example.com:path/my-repo"  (did:web)
+    // Split on the first `/` to separate DID from repo path.
+    const slashIdx = stripped.indexOf('/');
+    let didSuffix;
+    let repo;
+    if (slashIdx === -1) {
+        didSuffix = stripped;
+    }
+    else {
+        didSuffix = stripped.slice(0, slashIdx);
+        const pathPart = stripped.slice(slashIdx + 1);
+        if (pathPart.length > 0) {
+            repo = pathPart;
+        }
+    }
+    // Reconstruct full DID URI.
+    const did = `did:${didSuffix}`;
+    // Basic validation.
+    const parts = did.split(':');
+    if (parts.length < 3 || parts[0] !== 'did' || parts[1].length === 0 || parts[2].length === 0) {
+        throw new Error(`Invalid DID URL: "${url}" (parsed DID: "${did}")`);
+    }
+    return { did, repo };
+}
+//# sourceMappingURL=parse-url.js.map

package/dist/esm/git-remote/parse-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-url.js","sourceRoot":"","sources":["../../../src/git-remote/parse-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,QAAQ,GAAG,GAAG,CAAC;IAEnB,mDAAmD;IACnD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,uCAAuC;IACvC,qCAAqC;IACrC,4CAA4C;IAC5C,8CAA8C;IAE9C,yDAAyD;IACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEvC,IAAI,SAAiB,CAAC;IACtB,IAAI,IAAwB,CAAC;IAE7B,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,GAAG,GAAG,OAAO,SAAS,EAAE,CAAC;IAE/B,oBAAoB;IACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC"}

package/dist/esm/git-remote/resolve.js

@@ -0,0 +1,175 @@
+/**
+ * DID resolution and git transport endpoint discovery.
+ *
+ * Resolves a DID document and extracts the git transport endpoint URL.
+ * The resolution order is:
+ *   1. Service of type `GitTransport` (preferred)
+ *   2. Service of type `DecentralizedWebNode` with `/git` suffix appended
+ *   3. Failure — no git endpoint found
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { DidDht, DidJwk, DidKey, DidWeb, UniversalResolver } from '@enbox/dids';
+// ---------------------------------------------------------------------------
+// Resolver
+// ---------------------------------------------------------------------------
+/** Shared resolver instance (lazy-initialized). */
+let resolver;
+/** Get or create the DID resolver. */
+function getResolver() {
+    if (!resolver) {
+        resolver = new UniversalResolver({
+            didResolvers: [DidDht, DidJwk, DidWeb, DidKey],
+        });
+    }
+    return resolver;
+}
+/** DID resolution timeout in milliseconds. */
+const DID_RESOLUTION_TIMEOUT_MS = 30000;
+/**
+ * Resolve a DID to a git transport HTTPS endpoint.
+ *
+ * @param did - Full DID URI (e.g. `did:dht:abc123xyz`)
+ * @param repo - Optional repo name to append to the endpoint path
+ * @returns The resolved git transport endpoint
+ * @throws If resolution fails, times out, or no git-compatible service is found
+ */
+export function resolveGitEndpoint(did, repo) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const { didDocument, didResolutionMetadata } = yield Promise.race([
+            getResolver().resolve(did),
+            new Promise((_, reject) => setTimeout(() => reject(new Error(`DID resolution timed out after ${DID_RESOLUTION_TIMEOUT_MS}ms for ${did}`)), DID_RESOLUTION_TIMEOUT_MS)),
+        ]);
+        if (didResolutionMetadata.error) {
+            throw new Error(`DID resolution failed for ${did}: ${didResolutionMetadata.error}`);
+        }
+        if (!didDocument) {
+            throw new Error(`DID resolution returned no document for ${did}`);
+        }
+        const services = (_a = didDocument.service) !== null && _a !== void 0 ? _a : [];
+        // Priority 1: Look for a GitTransport service.
+        const gitService = services.find((s) => s.type === 'GitTransport');
+        if (gitService) {
+            const baseUrl = extractEndpointUrl(gitService);
+            return {
+                url: buildUrl(baseUrl, did, repo),
+                did,
+                source: 'GitTransport',
+            };
+        }
+        // Priority 2: Fall back to DWN endpoint + /git suffix.
+        const dwnService = services.find((s) => s.type === 'DecentralizedWebNode');
+        if (dwnService) {
+            const baseUrl = extractEndpointUrl(dwnService);
+            const gitUrl = baseUrl.replace(/\/$/, '') + '/git';
+            return {
+                url: buildUrl(gitUrl, did, repo),
+                did,
+                source: 'DecentralizedWebNode',
+            };
+        }
+        throw new Error(`No GitTransport or DecentralizedWebNode service found in DID document for ${did}. ` +
+            `Services: ${services.map((s) => s.type).join(', ') || '(none)'}`);
+    });
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Extract a URL string from a service endpoint (handles string and array forms). */
+function extractEndpointUrl(service) {
+    const ep = service.serviceEndpoint;
+    let url;
+    if (typeof ep === 'string') {
+        url = ep;
+    }
+    else if (Array.isArray(ep) && ep.length > 0) {
+        const first = ep[0];
+        if (typeof first === 'string') {
+            url = first;
+        }
+    }
+    if (!url) {
+        throw new Error(`Cannot extract URL from service endpoint: ${JSON.stringify(ep)}`);
+    }
+    assertNotPrivateUrl(url);
+    return url;
+}
+// ---------------------------------------------------------------------------
+// SSRF protection
+// ---------------------------------------------------------------------------
+/**
+ * Private / loopback IP ranges that must never be contacted via
+ * DID-resolved URLs (prevents SSRF attacks).
+ */
+const PRIVATE_IP_PATTERNS = [
+    /^127\./, // 127.0.0.0/8 loopback
+    /^10\./, // 10.0.0.0/8 private
+    /^172\.(1[6-9]|2\d|3[01])\./, // 172.16.0.0/12 private
+    /^192\.168\./, // 192.168.0.0/16 private
+    /^169\.254\./, // 169.254.0.0/16 link-local
+    /^0\./, // 0.0.0.0/8
+];
+const PRIVATE_IPV6_PATTERNS = [
+    /^::1$/, // IPv6 loopback
+    /^fc/i, // fc00::/7 unique local
+    /^fd/i, // fc00::/7 unique local
+    /^fe80:/i, // fe80::/10 link-local
+];
+/**
+ * Assert that a URL does not resolve to a private/loopback address.
+ * @throws If the URL hostname is a private or loopback IP
+ */
+function assertNotPrivateUrl(urlString) {
+    let parsed;
+    try {
+        parsed = new URL(urlString);
+    }
+    catch (_a) {
+        throw new Error(`Invalid URL from DID service endpoint: ${urlString}`);
+    }
+    const hostname = parsed.hostname;
+    // Strip IPv6 brackets if present.
+    const bare = hostname.startsWith('[') && hostname.endsWith(']')
+        ? hostname.slice(1, -1)
+        : hostname;
+    // Reject localhost by name.
+    if (bare === 'localhost' || bare.endsWith('.localhost')) {
+        throw new Error(`SSRF blocked: resolved endpoint points to localhost: ${urlString}`);
+    }
+    // Check IPv4 private ranges.
+    for (const pattern of PRIVATE_IP_PATTERNS) {
+        if (pattern.test(bare)) {
+            throw new Error(`SSRF blocked: resolved endpoint points to private IP: ${urlString}`);
+        }
+    }
+    // Check IPv6 private ranges.
+    for (const pattern of PRIVATE_IPV6_PATTERNS) {
+        if (pattern.test(bare)) {
+            throw new Error(`SSRF blocked: resolved endpoint points to private IPv6: ${urlString}`);
+        }
+    }
+}
+/**
+ * Build the full git transport URL: `<base>/<did>[/<repo>]`.
+ *
+ * The DID is always included in the path since the git HTTP handler uses
+ * it for routing and authorization.
+ */
+function buildUrl(base, did, repo) {
+    const normalized = base.replace(/\/$/, '');
+    if (!repo) {
+        return `${normalized}/${did}`;
+    }
+    return `${normalized}/${did}/${repo}`;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/esm/git-remote/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/git-remote/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;;;;;;;;;;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAkBhF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,mDAAmD;AACnD,IAAI,QAAuC,CAAC;AAE5C,sCAAsC;AACtC,SAAS,WAAW;IAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YAC/B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,KAAM,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,UAAgB,kBAAkB,CAAC,GAAW,EAAE,IAAa;;;QACjE,MAAM,EAAE,WAAW,EAAE,qBAAqB,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChE,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,yBAAyB,UAAU,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAC3I;SACF,CAAC,CAAC;QAEH,IAAI,qBAAqB,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,KAAK,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,QAAQ,GAAiB,MAAA,WAAW,CAAC,OAAO,mCAAI,EAAE,CAAC;QAEzD,+CAA+C;QAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QACnE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO;gBACL,GAAG,EAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;gBACrC,GAAG;gBACH,MAAM,EAAG,cAAc;aACxB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC;QAC3E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;YACnD,OAAO;gBACL,GAAG,EAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;gBACpC,GAAG;gBACH,MAAM,EAAG,sBAAsB;aAChC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CACb,6EAA6E,GAAG,IAAI;YACpF,aAAa,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAClE,CAAC;IACJ,CAAC;CAAA;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,qFAAqF;AACrF,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IAEnC,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,GAAG,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,mBAAmB,GAAa;IACpC,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,qBAAqB;IAC9B,4BAA4B,EAAE,wBAAwB;IACtD,aAAa,EAAE,yBAAyB;IACxC,aAAa,EAAE,4BAA4B;IAC3C,MAAM,EAAE,YAAY;CACrB,CAAC;AAEF,MAAM,qBAAqB,GAAa;IACtC,OAAO,EAAE,gBAAgB;IACzB,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,wBAAwB;IAChC,SAAS,EAAE,uBAAuB;CACnC,CAAC;AAEF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAEjC,kCAAkC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IAEb,4BAA4B;IAC5B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yDAAyD,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,2DAA2D,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW,EAAE,IAAa;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAC7C,OAAO,GAAG,UAAU,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/esm/git-remote/service.js

@@ -0,0 +1,82 @@
+/**
+ * GitTransport DID service type utilities.
+ *
+ * Provides helpers for creating and identifying `GitTransport` service entries
+ * in DID documents.  The `GitTransport` service type advertises a smart HTTP
+ * git endpoint that can be used by `git-remote-did` to locate repositories.
+ *
+ * When a DID document contains a GitTransport service, the git remote helper
+ * uses it directly (highest priority).  Otherwise it falls back to
+ * `DecentralizedWebNode` + `/git` suffix.
+ *
+ * @example
+ * ```ts
+ * import { createGitTransportService } from '@enbox/gitd/git-remote/service';
+ *
+ * const service = createGitTransportService({
+ *   id              : '#git',
+ *   serviceEndpoint : 'https://git.example.com',
+ * });
+ * // → { id: '#git', type: 'GitTransport', serviceEndpoint: 'https://git.example.com' }
+ * ```
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** The DID service type string for git smart HTTP transport endpoints. */
+export const GIT_TRANSPORT_SERVICE_TYPE = 'GitTransport';
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a `GitTransport` DID service entry.
+ *
+ * @param options - Service configuration
+ * @returns A well-formed GitTransport service entry ready for inclusion in a
+ *          DID document's `service` array.
+ */
+export function createGitTransportService(options) {
+    const { serviceEndpoint } = options;
+    let { id } = options;
+    // Normalize the id to include a # prefix if missing.
+    if (!id.startsWith('#')) {
+        id = `#${id}`;
+    }
+    // Validate endpoint(s).
+    const endpoints = Array.isArray(serviceEndpoint) ? serviceEndpoint : [serviceEndpoint];
+    for (const ep of endpoints) {
+        if (typeof ep !== 'string' || ep.length === 0) {
+            throw new Error(`GitTransport serviceEndpoint must be a non-empty string, got: ${JSON.stringify(ep)}`);
+        }
+    }
+    return {
+        id,
+        type: GIT_TRANSPORT_SERVICE_TYPE,
+        serviceEndpoint: Array.isArray(serviceEndpoint) ? serviceEndpoint : serviceEndpoint,
+    };
+}
+// ---------------------------------------------------------------------------
+// Queries
+// ---------------------------------------------------------------------------
+/**
+ * Check whether a DID service entry is a GitTransport service.
+ *
+ * @param service - A service entry from a DID document
+ * @returns `true` if the service type is `GitTransport`
+ */
+export function isGitTransportService(service) {
+    return service.type === GIT_TRANSPORT_SERVICE_TYPE;
+}
+/**
+ * Extract all GitTransport service entries from a DID document.
+ *
+ * @param didDocument - A resolved DID document
+ * @returns An array of GitTransport services (may be empty)
+ */
+export function getGitTransportServices(didDocument) {
+    var _a;
+    return ((_a = didDocument.service) !== null && _a !== void 0 ? _a : []).filter(isGitTransportService);
+}
+//# sourceMappingURL=service.js.map

package/dist/esm/git-remote/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/git-remote/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAuB,CAAC;AAkClE,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAyC;IAEzC,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;IAErB,qDAAqD;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;IAChB,CAAC;IAED,wBAAwB;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACvF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,iEAAiE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE;QACF,IAAI,EAAc,0BAA0B;QAC5C,eAAe,EAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;KACrF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACvD,OAAO,OAAO,CAAC,IAAI,KAAK,0BAA0B,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAwB;;IAC9D,OAAO,CAAC,MAAA,WAAW,CAAC,OAAO,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AACnE,CAAC"}

package/dist/esm/git-server/auth.js

@@ -0,0 +1,211 @@
+/**
+ * Push authentication for the git transport sidecar.
+ *
+ * Implements a DID-based authentication scheme for git push operations.
+ * The scheme uses signed tokens that prove DID ownership:
+ *
+ * 1. The client generates a token: `base64url(JSON({ did, repo, exp, nonce }))`
+ * 2. The client signs the token with their DID's Ed25519 key
+ * 3. The client sends the token + signature as HTTP Basic auth credentials:
+ *    - username: `did-auth` (fixed; DIDs contain colons so can't be usernames)
+ *    - password: `<base64url-signature>.<base64url-token>`
+ * 4. The server verifies the signature using the DID document's
+ *    authentication verification method
+ *
+ * This approach works with git's native credential helper system — no custom
+ * transport modifications required.
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { randomBytes } from 'node:crypto';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/**
+ * Fixed username for HTTP Basic auth.
+ * DIDs contain colons which conflict with HTTP Basic auth's username:password
+ * separator, so we use a fixed username and embed the DID in the token payload.
+ */
+export const DID_AUTH_USERNAME = 'did-auth';
+// ---------------------------------------------------------------------------
+// Token creation (client-side)
+// ---------------------------------------------------------------------------
+/**
+ * Create a push token payload.
+ *
+ * @param did - The pusher's DID
+ * @param owner - The repository owner's DID
+ * @param repo - The repository name
+ * @param ttlSeconds - Token lifetime in seconds (default: 300)
+ * @returns The token payload
+ */
+export function createPushTokenPayload(did, owner, repo, ttlSeconds = 300) {
+    return {
+        did,
+        owner,
+        repo,
+        exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+        nonce: randomBytes(16).toString('hex'),
+    };
+}
+/**
+ * Encode a push token payload as a base64url string.
+ *
+ * @param payload - The token payload
+ * @returns base64url-encoded JSON
+ */
+export function encodePushToken(payload) {
+    const json = JSON.stringify(payload);
+    return Buffer.from(json).toString('base64url');
+}
+/**
+ * Decode a base64url push token string back to a payload.
+ *
+ * @param token - The base64url-encoded token
+ * @returns The decoded payload
+ * @throws If the token is malformed
+ */
+export function decodePushToken(token) {
+    try {
+        const json = Buffer.from(token, 'base64url').toString('utf-8');
+        const payload = JSON.parse(json);
+        if (!payload.did || !payload.owner || !payload.repo || !payload.exp || !payload.nonce) {
+            throw new Error('missing required fields');
+        }
+        return payload;
+    }
+    catch (err) {
+        throw new Error(`Invalid push token: ${err.message}`);
+    }
+}
+/**
+ * Format a signed push token for use as an HTTP Basic auth password.
+ * The format is `<base64url-signature>.<base64url-token>`.
+ *
+ * @param signed - The signed token
+ * @returns The formatted password string
+ */
+export function formatAuthPassword(signed) {
+    return `${signed.signature}.${signed.token}`;
+}
+/**
+ * Parse an HTTP Basic auth password back into a signed push token.
+ *
+ * @param password - The password from HTTP Basic auth
+ * @returns The parsed signed token
+ * @throws If the format is invalid
+ */
+export function parseAuthPassword(password) {
+    const dotIndex = password.indexOf('.');
+    if (dotIndex === -1) {
+        throw new Error('Invalid auth password format: expected <signature>.<token>');
+    }
+    return {
+        signature: password.slice(0, dotIndex),
+        token: password.slice(dotIndex + 1),
+    };
+}
+// ---------------------------------------------------------------------------
+// Push authenticator factory (server-side)
+// ---------------------------------------------------------------------------
+/**
+ * Create an `authenticatePush` callback for use with `createGitHttpHandler`.
+ *
+ * Extracts HTTP Basic credentials from the request, verifies the signed token,
+ * and optionally checks role-based authorization.
+ *
+ * @param options - Authenticator configuration
+ * @returns An authenticatePush callback
+ */
+export function createPushAuthenticator(options) {
+    const { verifySignature, authorizePush, maxTokenAge = 300 } = options;
+    // Nonce replay protection: track used nonces with timestamps for TTL eviction.
+    const usedNonces = new Map();
+    const nonceMaxAge = (maxTokenAge + 60) * 1000; // ms — token TTL + clock skew
+    /** Evict expired nonces to prevent unbounded growth. */
+    function evictExpiredNonces() {
+        const cutoff = Date.now() - nonceMaxAge;
+        for (const [nonce, ts] of usedNonces) {
+            if (ts < cutoff) {
+                usedNonces.delete(nonce);
+            }
+        }
+    }
+    return (request, ownerDid, repo) => __awaiter(this, void 0, void 0, function* () {
+        // Extract HTTP Basic auth credentials.
+        // Username is fixed to "did-auth" (DIDs contain colons, which conflict
+        // with HTTP Basic auth's colon separator). The DID is inside the token.
+        const authHeader = request.headers.get('Authorization');
+        if (!(authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Basic '))) {
+            return false;
+        }
+        const decoded = Buffer.from(authHeader.slice(6), 'base64').toString('utf-8');
+        const colonIdx = decoded.indexOf(':');
+        if (colonIdx === -1) {
+            return false;
+        }
+        const username = decoded.slice(0, colonIdx);
+        const password = decoded.slice(colonIdx + 1);
+        // Verify the username is the expected fixed value.
+        if (username !== DID_AUTH_USERNAME) {
+            return false;
+        }
+        // Parse the signed token from the password field.
+        let signed;
+        try {
+            signed = parseAuthPassword(password);
+        }
+        catch (_a) {
+            return false;
+        }
+        // Decode and validate the token payload.
+        let payload;
+        try {
+            payload = decodePushToken(signed.token);
+        }
+        catch (_b) {
+            return false;
+        }
+        // Verify the token targets the correct owner and repo.
+        if (payload.owner !== ownerDid || payload.repo !== repo) {
+            return false;
+        }
+        // Verify the token hasn't expired.
+        const now = Math.floor(Date.now() / 1000);
+        if (payload.exp < now) {
+            return false;
+        }
+        // Verify the token isn't too far in the future (clock skew protection).
+        if (payload.exp > now + maxTokenAge + 60) {
+            return false;
+        }
+        // Verify the Ed25519 signature.
+        const tokenBytes = new TextEncoder().encode(signed.token);
+        const signatureBytes = new Uint8Array(Buffer.from(signed.signature, 'base64url'));
+        const signatureValid = yield verifySignature(payload.did, tokenBytes, signatureBytes);
+        if (!signatureValid) {
+            return false;
+        }
+        // Nonce replay protection — reject already-used nonces.
+        evictExpiredNonces();
+        if (usedNonces.has(payload.nonce)) {
+            return false;
+        }
+        usedNonces.set(payload.nonce, Date.now());
+        // Optional: Check role-based push authorization.
+        if (authorizePush) {
+            return authorizePush(payload.did, ownerDid, repo);
+        }
+        return true;
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/esm/git-server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/git-server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AA8E5C,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,KAAa,EACb,IAAY,EACZ,aAAqB,GAAG;IAExB,OAAO;QACL,GAAG;QACH,KAAK;QACL,IAAI;QACJ,GAAG,EAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU;QAClD,KAAK,EAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QAErD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,OAAO,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACL,SAAS,EAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;QACvC,KAAK,EAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAiC;IAEjC,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC;IAEtE,+EAA+E;IAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,WAAW,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,8BAA8B;IAE7E,wDAAwD;IACxD,SAAS,kBAAkB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACxC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;gBAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,CAAO,OAAgB,EAAE,QAAgB,EAAE,IAAY,EAAoB,EAAE;QAClF,uCAAuC;QACvC,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,UAAU,CAAC,QAAQ,CAAC,CAAA,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE7C,mDAAmD;QACnD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kDAAkD;QAClD,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yCAAyC;QACzC,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,uDAAuD;QACvD,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mCAAmC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wEAAwE;QACxE,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,WAAW,GAAG,EAAE,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gCAAgC;QAChC,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAElF,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACtF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wDAAwD;QACxD,kBAAkB,EAAE,CAAC;QACrB,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1C,iDAAiD;QACjD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;AACJ,CAAC"}