@enbox/gitd 0.0.1

package/dist/esm/git-server/git-backend.js

@@ -0,0 +1,186 @@
+/**
+ * Git backend — wraps Git CLI commands for bare repository management.
+ *
+ * Provides a thin abstraction over `git init --bare`, `git upload-pack`, and
+ * `git receive-pack` for use by the smart HTTP transport handler.
+ *
+ * All repositories are stored as bare repos under a configurable base
+ * directory, organized by DID:  `<basePath>/<did-hash>/<repo-name>.git`
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { join, resolve } from 'node:path';
+import { existsSync, mkdirSync } from 'node:fs';
+// ---------------------------------------------------------------------------
+// GitBackend
+// ---------------------------------------------------------------------------
+/**
+ * Manages bare git repositories on the filesystem and spawns git subprocess
+ * for smart HTTP transport.
+ */
+export class GitBackend {
+    constructor(options) {
+        this._basePath = options.basePath;
+    }
+    /** Get the base path for all repositories. */
+    get basePath() {
+        return this._basePath;
+    }
+    /**
+     * Compute the filesystem path for a repository.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns Absolute path to the bare repo directory
+     * @throws If the repo name contains path traversal characters
+     */
+    repoPath(did, repo) {
+        validateRepoName(repo);
+        const didHash = hashDid(did);
+        const repoDir = join(this._basePath, didHash, `${repo}.git`);
+        const resolved = resolve(repoDir);
+        const base = resolve(this._basePath);
+        if (!resolved.startsWith(base + '/') && resolved !== base) {
+            throw new Error(`Path traversal detected: repo name '${repo}' escapes base directory`);
+        }
+        return resolved;
+    }
+    /**
+     * Check whether a repository exists on disk.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     */
+    exists(did, repo) {
+        const path = this.repoPath(did, repo);
+        return existsSync(join(path, 'HEAD'));
+    }
+    /**
+     * Initialize a new bare repository.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns The path to the new bare repository
+     * @throws If `git init --bare` fails
+     */
+    initRepo(did, repo) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const path = this.repoPath(did, repo);
+            mkdirSync(path, { recursive: true });
+            const exitCode = yield runGit(['init', '--bare', path]);
+            if (exitCode !== 0) {
+                throw new Error(`git init --bare failed with exit code ${exitCode} for ${path}`);
+            }
+            return path;
+        });
+    }
+    /**
+     * Spawn `git upload-pack` for fetch/clone operations.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns A GitProcess with stdin/stdout streams for the subprocess
+     * @throws If the repository does not exist
+     */
+    uploadPack(did, repo) {
+        this._assertRepoExists(did, repo);
+        const path = this.repoPath(did, repo);
+        return spawnGitService('upload-pack', path);
+    }
+    /**
+     * Spawn `git receive-pack` for push operations.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns A GitProcess with stdin/stdout streams for the subprocess
+     * @throws If the repository does not exist
+     */
+    receivePack(did, repo) {
+        this._assertRepoExists(did, repo);
+        const path = this.repoPath(did, repo);
+        return spawnGitService('receive-pack', path);
+    }
+    /** Throw if the repo doesn't exist on disk. */
+    _assertRepoExists(did, repo) {
+        if (!this.exists(did, repo)) {
+            throw new Error(`Repository not found: ${did}/${repo}`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Allowed characters in a repository name: alphanumeric, dots, hyphens, underscores. */
+const SAFE_REPO_NAME_RE = /^[a-zA-Z0-9._-]+$/;
+/**
+ * Validate that a repository name is safe for filesystem use.
+ * Rejects path traversal components and unsafe characters.
+ *
+ * @throws If the repo name is invalid
+ */
+function validateRepoName(name) {
+    if (!name || !SAFE_REPO_NAME_RE.test(name)) {
+        throw new Error(`Invalid repository name: '${name}'. Names must match ${SAFE_REPO_NAME_RE}`);
+    }
+    if (name === '.' || name === '..' || name.startsWith('.git')) {
+        throw new Error(`Invalid repository name: '${name}'`);
+    }
+}
+/** Hash a DID to a short filesystem-safe directory name. */
+function hashDid(did) {
+    return createHash('sha256').update(did).digest('hex').slice(0, 16);
+}
+/** Run a git command and return the exit code. */
+function runGit(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return new Promise((resolve, reject) => {
+            const child = spawn('git', args, { stdio: 'pipe' });
+            child.on('error', reject);
+            child.on('exit', (code) => resolve(code !== null && code !== void 0 ? code : 128));
+        });
+    });
+}
+/**
+ * Spawn a git service subprocess (upload-pack or receive-pack) and return
+ * web-standard ReadableStream/WritableStream wrappers around its stdio.
+ */
+function spawnGitService(service, repoPath) {
+    const child = spawn('git', [service, '--stateless-rpc', repoPath], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const stdout = new ReadableStream({
+        start(controller) {
+            child.stdout.on('data', (chunk) => controller.enqueue(new Uint8Array(chunk)));
+            child.stdout.on('end', () => controller.close());
+            child.stdout.on('error', (err) => controller.error(err));
+        },
+    });
+    const stdin = new WritableStream({
+        write(chunk) {
+            child.stdin.write(chunk);
+        },
+        close() {
+            child.stdin.end();
+        },
+        abort() {
+            child.stdin.destroy();
+        },
+    });
+    const exitCode = new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('exit', (code) => resolve(code !== null && code !== void 0 ? code : 128));
+    });
+    return { stdout, stdin, exitCode };
+}
+//# sourceMappingURL=git-backend.js.map

package/dist/esm/git-server/git-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-backend.js","sourceRoot":"","sources":["../../../src/git-server/git-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AA2BhD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,OAAO,UAAU;IAGrB,YAAmB,OAA0B;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,IAAW,QAAQ;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACI,QAAQ,CAAC,GAAW,EAAE,IAAY;QACvC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,0BAA0B,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,GAAW,EAAE,IAAY;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACU,QAAQ,CAAC,GAAW,EAAE,IAAY;;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAErC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YACxD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,QAAQ,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAED;;;;;;;OAOG;IACI,UAAU,CAAC,GAAW,EAAE,IAAY;QACzC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACI,WAAW,CAAC,GAAW,EAAE,IAAY;QAC1C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,+CAA+C;IACvC,iBAAiB,CAAC,GAAW,EAAE,IAAY;QACjD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,uBAAuB,iBAAiB,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,kDAAkD;AAClD,SAAe,MAAM,CAAC,IAAc;;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACpD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;CAAA;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAuC,EAAE,QAAgB;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE;QACjE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC5C,KAAK,CAAC,UAAU;YACd,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvF,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAClD,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,cAAc,CAAa;QAC3C,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK;YACH,KAAK,CAAC,KAAM,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC;QACD,KAAK;YACH,KAAK,CAAC,KAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}

package/dist/esm/git-server/http-handler.js

@@ -0,0 +1,295 @@
+/**
+ * Git smart HTTP transport handler.
+ *
+ * Implements the server side of Git's smart HTTP protocol (v1):
+ *   - `GET /<did>/<repo>/info/refs?service=git-upload-pack`  — ref discovery (clone/fetch)
+ *   - `POST /<did>/<repo>/git-upload-pack`                   — pack negotiation (clone/fetch)
+ *   - `GET /<did>/<repo>/info/refs?service=git-receive-pack` — ref discovery (push)
+ *   - `POST /<did>/<repo>/git-receive-pack`                  — receive pack (push)
+ *
+ * When `onRepoNotFound` is provided, the handler auto-restores repos from
+ * DWN bundle records on first access (cold-start). This enables commodity
+ * git hosts to serve repos they've never seen before.
+ *
+ * The handler is a pure function `(Request) => Response | Promise<Response>`
+ * suitable for use with `Bun.serve()`, `Deno.serve()`, or any fetch-compatible
+ * HTTP runtime.
+ *
+ * URL format: `/<did>/<repo>/...`
+ *   The DID is URL-encoded in the path (colons are preserved since they're
+ *   valid in path segments).
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { spawn } from 'node:child_process';
+// ---------------------------------------------------------------------------
+// Handler factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a fetch-compatible HTTP handler for Git smart HTTP transport.
+ *
+ * @param options - Handler configuration
+ * @returns A function that handles incoming HTTP requests
+ */
+export function createGitHttpHandler(options) {
+    const { backend, authenticatePush, onPushComplete, onRepoNotFound, pathPrefix = '' } = options;
+    /**
+     * Ensure a repo exists on disk, attempting DWN bundle restore if absent.
+     * Returns `true` when the repo is available (or was restored).
+     */
+    function ensureRepo(did, repo) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (backend.exists(did, repo)) {
+                return true;
+            }
+            if (onRepoNotFound) {
+                const repoPath = backend.repoPath(did, repo);
+                try {
+                    return yield onRepoNotFound(did, repo, repoPath);
+                }
+                catch (err) {
+                    console.error(`onRepoNotFound error for ${did}/${repo}: ${err.message}`);
+                    return false;
+                }
+            }
+            return false;
+        });
+    }
+    return (request) => __awaiter(this, void 0, void 0, function* () {
+        const url = new URL(request.url);
+        let pathname = url.pathname;
+        // Strip path prefix.
+        if (pathPrefix && pathname.startsWith(pathPrefix)) {
+            pathname = pathname.slice(pathPrefix.length);
+        }
+        // Parse the route.
+        const route = parseRoute(pathname);
+        if (!route) {
+            return new Response('Not Found', { status: 404 });
+        }
+        const { did, repo, action } = route;
+        // -----------------------------------------------------------------------
+        // GET /<did>/<repo>/info/refs?service=<service>
+        // -----------------------------------------------------------------------
+        if (request.method === 'GET' && action === 'info/refs') {
+            const service = url.searchParams.get('service');
+            if (service !== 'git-upload-pack' && service !== 'git-receive-pack') {
+                return new Response('Dumb HTTP transport is not supported. Use git smart HTTP.', { status: 403 });
+            }
+            // Auth check for push ref discovery.
+            if (service === 'git-receive-pack' && authenticatePush) {
+                const authorized = yield authenticatePush(request, did, repo);
+                if (!authorized) {
+                    return new Response('Unauthorized', {
+                        status: 401,
+                        headers: { 'WWW-Authenticate': 'Basic realm="gitd"' },
+                    });
+                }
+            }
+            // Ensure repo exists (auto-restore from DWN if possible).
+            if (!(yield ensureRepo(did, repo))) {
+                return new Response('Repository not found', { status: 404 });
+            }
+            return handleInfoRefs(backend, did, repo, service);
+        }
+        // -----------------------------------------------------------------------
+        // POST /<did>/<repo>/git-upload-pack
+        // -----------------------------------------------------------------------
+        if (request.method === 'POST' && action === 'git-upload-pack') {
+            if (!(yield ensureRepo(did, repo))) {
+                return new Response('Repository not found', { status: 404 });
+            }
+            return handleServiceRpc(backend, did, repo, 'upload-pack', request);
+        }
+        // -----------------------------------------------------------------------
+        // POST /<did>/<repo>/git-receive-pack
+        // -----------------------------------------------------------------------
+        if (request.method === 'POST' && action === 'git-receive-pack') {
+            // Auth check for push.
+            if (authenticatePush) {
+                const authorized = yield authenticatePush(request, did, repo);
+                if (!authorized) {
+                    return new Response('Unauthorized', {
+                        status: 401,
+                        headers: { 'WWW-Authenticate': 'Basic realm="gitd"' },
+                    });
+                }
+            }
+            if (!(yield ensureRepo(did, repo))) {
+                return new Response('Repository not found', { status: 404 });
+            }
+            const response = yield handleServiceRpc(backend, did, repo, 'receive-pack', request);
+            // Fire the post-push callback asynchronously (don't block the response).
+            if (onPushComplete && response.status === 200) {
+                const repoPath = backend.repoPath(did, repo);
+                onPushComplete(did, repo, repoPath).catch((err) => {
+                    console.error(`onPushComplete error for ${did}/${repo}: ${err.message}`);
+                });
+            }
+            return response;
+        }
+        return new Response('Not Found', { status: 404 });
+    });
+}
+// ---------------------------------------------------------------------------
+// Route parsing
+// ---------------------------------------------------------------------------
+/**
+ * Parse a URL path into DID, repo, and action components.
+ *
+ * Expected format: `/<did>/<repo>/<action>`
+ * The DID occupies exactly 3 colon-separated segments: `did:<method>:<id>`.
+ * However, since the DID is in the URL path, we split by `/` and reconstruct.
+ *
+ * URL form: `/<did-scheme>:<did-method>:<did-id>/<repo>/<action...>`
+ * Example:  `/did:dht:abc123/my-repo/info/refs`
+ */
+function parseRoute(pathname) {
+    // Remove leading slash.
+    const path = pathname.startsWith('/') ? pathname.slice(1) : pathname;
+    // The DID is the first path segment (contains colons, not slashes).
+    const firstSlash = path.indexOf('/');
+    if (firstSlash === -1) {
+        return undefined;
+    }
+    const did = decodeURIComponent(path.slice(0, firstSlash));
+    // Validate it looks like a DID.
+    if (!did.startsWith('did:') || did.split(':').length < 3) {
+        return undefined;
+    }
+    // Remaining path: <repo>/<action...>
+    const rest = path.slice(firstSlash + 1);
+    const secondSlash = rest.indexOf('/');
+    if (secondSlash === -1) {
+        return undefined;
+    }
+    const repo = rest.slice(0, secondSlash);
+    const action = rest.slice(secondSlash + 1);
+    if (!repo || !action) {
+        return undefined;
+    }
+    // Reject path-traversal and unsafe repo names.
+    if (!/^[a-zA-Z0-9._-]+$/.test(repo) || repo === '.' || repo === '..') {
+        return undefined;
+    }
+    return { did, repo, action };
+}
+// ---------------------------------------------------------------------------
+// Git smart HTTP protocol handlers
+// ---------------------------------------------------------------------------
+/** Git pkt-line helper: encode a single line. */
+function pktLine(line) {
+    const len = line.length + 4;
+    return len.toString(16).padStart(4, '0') + line;
+}
+/** Git pkt-line flush: `0000`. */
+const PKT_FLUSH = '0000';
+/**
+ * Handle `GET /info/refs?service=<service>`.
+ *
+ * Runs `git <service> --stateless-rpc --advertise-refs` and wraps the output
+ * in the smart HTTP ref advertisement format.
+ */
+function handleInfoRefs(backend, did, repo, service) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const gitService = service === 'git-upload-pack' ? 'upload-pack' : 'receive-pack';
+        const repoPath = backend.repoPath(did, repo);
+        // Run git with --advertise-refs to get the ref listing.
+        const refData = yield spawnAndCollect(gitService, repoPath);
+        if (refData === null) {
+            return new Response('Git service error', { status: 500 });
+        }
+        // Build the smart HTTP response: service announcement + ref data.
+        const encoder = new TextEncoder();
+        const announcement = pktLine(`# service=${service}\n`) + PKT_FLUSH;
+        const announcementBytes = encoder.encode(announcement);
+        const body = new Uint8Array(announcementBytes.length + refData.length);
+        body.set(announcementBytes, 0);
+        body.set(refData, announcementBytes.length);
+        return new Response(body, {
+            status: 200,
+            headers: {
+                'Content-Type': `application/x-${service}-advertisement`,
+                'Cache-Control': 'no-cache',
+            },
+        });
+    });
+}
+/**
+ * Handle `POST /git-upload-pack` or `POST /git-receive-pack`.
+ *
+ * Pipes the request body to `git <service> --stateless-rpc` stdin and
+ * streams stdout back as the response.
+ */
+function handleServiceRpc(backend, did, repo, service, request) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const gitProcess = service === 'upload-pack'
+            ? backend.uploadPack(did, repo)
+            : backend.receivePack(did, repo);
+        // Pipe request body into git subprocess stdin.
+        if (request.body) {
+            const writer = gitProcess.stdin.getWriter();
+            const reader = request.body.getReader();
+            try {
+                while (true) {
+                    const { done, value } = yield reader.read();
+                    if (done) {
+                        break;
+                    }
+                    yield writer.write(value);
+                }
+            }
+            finally {
+                yield writer.close();
+                reader.releaseLock();
+            }
+        }
+        else {
+            const writer = gitProcess.stdin.getWriter();
+            yield writer.close();
+        }
+        return new Response(gitProcess.stdout, {
+            status: 200,
+            headers: {
+                'Content-Type': `application/x-git-${service}-result`,
+                'Cache-Control': 'no-cache',
+            },
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Spawn `git <service> --stateless-rpc --advertise-refs` and collect stdout.
+ * Returns `null` if the process exits with a non-zero code.
+ */
+function spawnAndCollect(service, repoPath) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', [service, '--stateless-rpc', '--advertise-refs', repoPath], {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const chunks = [];
+        child.stdout.on('data', (chunk) => chunks.push(chunk));
+        child.stdout.on('error', reject);
+        child.on('error', reject);
+        child.on('exit', (code) => {
+            if (code !== 0) {
+                resolve(null);
+            }
+            else {
+                resolve(new Uint8Array(Buffer.concat(chunks)));
+            }
+        });
+    });
+}
+//# sourceMappingURL=http-handler.js.map

package/dist/esm/git-server/http-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-handler.js","sourceRoot":"","sources":["../../../src/git-server/http-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;;;;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA8D3C,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA8B;IAE9B,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAE/F;;;OAGG;IACH,SAAe,UAAU,CAAC,GAAW,EAAE,IAAY;;YACjD,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAE/C,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,IAAI,CAAC;oBACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,IAAI,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpF,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED,OAAO,CAAO,OAAgB,EAAqB,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE5B,qBAAqB;QACrB,IAAI,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,mBAAmB;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAEpC,0EAA0E;QAC1E,gDAAgD;QAChD,0EAA0E;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,OAAO,KAAK,iBAAiB,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;gBACpE,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpG,CAAC;YAED,qCAAqC;YACrC,IAAI,OAAO,KAAK,kBAAkB,IAAI,gBAAgB,EAAE,CAAC;gBACvD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE;wBAClC,MAAM,EAAI,GAAG;wBACb,OAAO,EAAG,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,0DAA0D;YAC1D,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,0EAA0E;QAC1E,qCAAqC;QACrC,0EAA0E;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC9D,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QACtE,CAAC;QAED,0EAA0E;QAC1E,sCAAsC;QACtC,0EAA0E;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC/D,uBAAuB;YACvB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE;wBAClC,MAAM,EAAI,GAAG;wBACb,OAAO,EAAG,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;YAErF,yEAAyE;YACzE,IAAI,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAChD,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,IAAI,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtF,CAAC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,QAAgB;IAClC,wBAAwB;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAErE,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAE5C,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAE1D,gCAAgC;IAChC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qCAAqC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAE7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;IAE3C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAE3C,+CAA+C;IAC/C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,iDAAiD;AACjD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AAClD,CAAC;AAED,kCAAkC;AAClC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;;;;GAKG;AACH,SAAe,cAAc,CAC3B,OAAmB,EACnB,GAAW,EACX,IAAY,EACZ,OAA+C;;QAE/C,MAAM,UAAU,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;QAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE7C,wDAAwD;QACxD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE5D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,OAAO,IAAI,CAAC,GAAG,SAAS,CAAC;QACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE5C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAI,GAAG;YACb,OAAO,EAAG;gBACR,cAAc,EAAI,iBAAiB,OAAO,gBAAgB;gBAC1D,eAAe,EAAG,UAAU;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;CAAA;AAED;;;;;GAKG;AACH,SAAe,gBAAgB,CAC7B,OAAmB,EACnB,GAAW,EACX,IAAY,EACZ,OAAuC,EACvC,OAAgB;;QAEhB,MAAM,UAAU,GAAG,OAAO,KAAK,aAAa;YAC1C,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC;YAC/B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEnC,+CAA+C;QAC/C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI,EAAE,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBACpB,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE;YACrC,MAAM,EAAI,GAAG;YACb,OAAO,EAAG;gBACR,cAAc,EAAI,qBAAqB,OAAO,SAAS;gBACvD,eAAe,EAAG,UAAU;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;CAAA;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE;YACrF,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAElC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/git-server/index.js

@@ -0,0 +1,16 @@
+/**
+ * Git transport server — smart HTTP git backend with DID-based push auth.
+ *
+ * @module git-server
+ */
+export * from './auth.js';
+export * from './bundle-restore.js';
+export * from './bundle-sync.js';
+export * from './did-service.js';
+export * from './git-backend.js';
+export * from './http-handler.js';
+export * from './push-authorizer.js';
+export * from './ref-sync.js';
+export * from './server.js';
+export * from './verify.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/git-server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/git-server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/esm/git-server/push-authorizer.js

@@ -0,0 +1,62 @@
+/**
+ * DWN-based push authorization — checks collaborator roles in the DWN.
+ *
+ * When a DID attempts to push to a repository, this module queries the
+ * DWN for `repo/maintainer` and `repo/contributor` role records to
+ * determine if the pusher is authorized.
+ *
+ * Authorization rules:
+ * - The repo owner (DID that owns the DWN) can always push
+ * - DIDs with a `maintainer` role record can push
+ * - DIDs with a `contributor` role record can push
+ * - All other DIDs are rejected
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Create a `PushAuthorizer` that checks DWN collaborator role records.
+ *
+ * The authorizer queries the ForgeRepoProtocol for `maintainer` and
+ * `contributor` role records matching the pusher's DID. The repo owner
+ * is always authorized.
+ *
+ * @param options - Authorizer configuration
+ * @returns A PushAuthorizer callback
+ */
+export function createDwnPushAuthorizer(options) {
+    const { repo, ownerDid } = options;
+    return (did, owner, _repoName) => __awaiter(this, void 0, void 0, function* () {
+        // The owner can always push to their own repos.
+        if (did === owner || did === ownerDid) {
+            return true;
+        }
+        // Query for maintainer role records for this DID.
+        const { records: maintainers } = yield repo.records.query('repo/maintainer', {
+            filter: { tags: { did } },
+        });
+        if (maintainers.length > 0) {
+            return true;
+        }
+        // Query for contributor role records for this DID.
+        const { records: contributors } = yield repo.records.query('repo/contributor', {
+            filter: { tags: { did } },
+        });
+        if (contributors.length > 0) {
+            return true;
+        }
+        return false;
+    });
+}
+//# sourceMappingURL=push-authorizer.js.map

package/dist/esm/git-server/push-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-authorizer.js","sourceRoot":"","sources":["../../../src/git-server/push-authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;AAqBH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAEnC,OAAO,CAAO,GAAW,EAAE,KAAa,EAAE,SAAiB,EAAoB,EAAE;QAC/E,gDAAgD;QAChD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kDAAkD;QAClD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAwB,EAAE;YAClF,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAyB,EAAE;YACpF,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAA,CAAC;AACJ,CAAC"}