@enbox/gitd 0.0.1

package/dist/esm/git-server/ref-sync.js

@@ -0,0 +1,132 @@
+/**
+ * Git ref → DWN sync — mirrors git branch/tag refs as ForgeRefs records.
+ *
+ * After a successful `git push`, this module reads the current refs from
+ * the bare repository and creates or updates corresponding DWN records
+ * using the ForgeRefsProtocol.
+ *
+ * Ref sync flow:
+ * 1. Run `git for-each-ref` on the bare repo to enumerate current refs
+ * 2. Query existing DWN ref records for the repo
+ * 3. Create new records for refs that don't exist in DWN
+ * 4. Update existing records whose target (SHA) has changed
+ * 5. Delete DWN records for refs that no longer exist in git
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { spawn } from 'node:child_process';
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Create an `onPushComplete` callback that syncs git refs to DWN records.
+ *
+ * @param options - Ref sync configuration
+ * @returns An async callback to invoke after a successful push
+ */
+export function createRefSyncer(options) {
+    const { refs, repoContextId } = options;
+    return (_did, _repo, repoPath) => __awaiter(this, void 0, void 0, function* () {
+        // Read current git refs from the bare repository.
+        const gitRefs = yield readGitRefs(repoPath);
+        // Query existing DWN ref records for this repo.
+        // The parentContextId links ref records to the repo context via $ref.
+        const { records: existingRecords } = yield refs.records.query('repo/ref');
+        // Build a map of existing DWN refs: name → { record, target }.
+        const existingMap = new Map();
+        for (const record of existingRecords) {
+            const data = yield record.data.json();
+            existingMap.set(data.name, { record, target: data.target });
+        }
+        // Build a set of current git ref names.
+        const gitRefNames = new Set(gitRefs.map((r) => r.name));
+        // Create or update refs.
+        for (const ref of gitRefs) {
+            const existing = existingMap.get(ref.name);
+            if (!existing) {
+                // Create a new DWN ref record.
+                yield refs.records.create('repo/ref', {
+                    data: { name: ref.name, target: ref.target, type: ref.type },
+                    tags: { name: ref.name, type: ref.type, target: ref.target },
+                    parentContextId: repoContextId,
+                });
+            }
+            else if (existing.target !== ref.target) {
+                // Update existing record with new target.
+                yield existing.record.update({
+                    data: { name: ref.name, target: ref.target, type: ref.type },
+                    tags: { name: ref.name, type: ref.type, target: ref.target },
+                });
+            }
+            // If target matches, no action needed.
+        }
+        // Delete DWN records for refs that no longer exist in git.
+        for (const [name, { record }] of existingMap) {
+            if (!gitRefNames.has(name)) {
+                yield record.delete();
+            }
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Git ref reader
+// ---------------------------------------------------------------------------
+/**
+ * Read all refs from a bare git repository using `git for-each-ref`.
+ *
+ * @param repoPath - Path to the bare git repository
+ * @returns Array of GitRef objects
+ */
+export function readGitRefs(repoPath) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const output = yield spawnCollectStdout('git', [
+            'for-each-ref',
+            '--format=%(refname)\t%(objectname)',
+            'refs/heads/',
+            'refs/tags/',
+        ], repoPath);
+        const refs = [];
+        for (const line of output.split('\n')) {
+            if (!line.trim()) {
+                continue;
+            }
+            const [name, target] = line.split('\t');
+            if (!name || !target) {
+                continue;
+            }
+            const type = name.startsWith('refs/tags/') ? 'tag' : 'branch';
+            refs.push({ name, target, type });
+        }
+        return refs;
+    });
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Spawn a process, collect stdout, and return it as a string. */
+function spawnCollectStdout(cmd, args, cwd) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+        const chunks = [];
+        child.stdout.on('data', (chunk) => chunks.push(chunk));
+        child.on('error', reject);
+        child.on('exit', (code) => {
+            if (code !== 0) {
+                resolve(''); // Empty refs for non-zero exit (e.g., empty repo).
+            }
+            else {
+                resolve(Buffer.concat(chunks).toString('utf-8'));
+            }
+        });
+    });
+}
+//# sourceMappingURL=ref-sync.js.map

package/dist/esm/git-server/ref-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-sync.js","sourceRoot":"","sources":["../../../src/git-server/ref-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAkC3C,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB;IACrD,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAExC,OAAO,CAAO,IAAY,EAAE,KAAa,EAAE,QAAgB,EAAiB,EAAE;QAC5E,kDAAkD;QAClD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE5C,gDAAgD;QAChD,sEAAsE;QACtE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAiB,CAAC,CAAC;QAEjF,+DAA+D;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2C,CAAC;QACvE,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,wCAAwC;QACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAExD,yBAAyB;QACzB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,+BAA+B;gBAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;oBACpC,IAAI,EAAc,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;oBACxE,IAAI,EAAc,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;oBACxE,eAAe,EAAG,aAAa;iBAChC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1C,0CAA0C;gBAC1C,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;oBAC7D,IAAI,EAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,uCAAuC;QACzC,CAAC;QAED,2DAA2D;QAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAgB,WAAW,CAAC,QAAgB;;QAChD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE;YAC7C,cAAc;YACd,oCAAoC;YACpC,aAAa;YACb,YAAY;SACb,EAAE,QAAQ,CAAC,CAAC;QAEb,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAEnC,MAAM,IAAI,GAAqB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,mDAAmD;YAClE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/git-server/server.js

@@ -0,0 +1,185 @@
+/**
+ * Git transport sidecar server.
+ *
+ * A standalone HTTP server that serves Git smart HTTP transport alongside
+ * a DWN.  Uses Node.js `http` module for maximum compatibility.
+ *
+ * Usage:
+ * ```ts
+ * import { createGitServer } from '@enbox/gitd/git-server/server';
+ *
+ * const server = createGitServer({
+ *   basePath : '/var/lib/gitd/repos',
+ *   port     : 9418,
+ * });
+ *
+ * console.log(`Git server listening on port ${server.port}`);
+ * ```
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createServer } from 'node:http';
+import { createGitHttpHandler } from './http-handler.js';
+import { GitBackend } from './git-backend.js';
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+/** Default maximum request body size for git pack data (50 MB). */
+const DEFAULT_MAX_BODY_GIT = 50 * 1024 * 1024;
+// ---------------------------------------------------------------------------
+// Server factory
+// ---------------------------------------------------------------------------
+/**
+ * Create and start a git transport sidecar server.
+ *
+ * @param options - Server configuration
+ * @returns A promise resolving to a running GitServer instance
+ */
+export function createGitServer(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { basePath, port = 9418, hostname = '0.0.0.0', pathPrefix, authenticatePush, onPushComplete, onRepoNotFound, maxBodySize = DEFAULT_MAX_BODY_GIT, } = options;
+        const backend = new GitBackend({ basePath });
+        const fetchHandler = createGitHttpHandler({
+            backend,
+            pathPrefix,
+            authenticatePush,
+            onPushComplete,
+            onRepoNotFound,
+        });
+        const server = createServer((req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            // Health check endpoint.
+            if (req.url === '/health') {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ status: 'ok', service: 'git-server' }));
+                return;
+            }
+            try {
+                // Build a Request object from the Node.js IncomingMessage.
+                const url = `http://${(_a = req.headers.host) !== null && _a !== void 0 ? _a : 'localhost'}${(_b = req.url) !== null && _b !== void 0 ? _b : '/'}`;
+                const headers = new Headers();
+                for (const [key, value] of Object.entries(req.headers)) {
+                    if (value) {
+                        headers.set(key, Array.isArray(value) ? value.join(', ') : value);
+                    }
+                }
+                // Collect request body for POST with size limit.
+                let body;
+                if (req.method === 'POST') {
+                    const collected = yield collectRequestBody(req, maxBodySize);
+                    if (collected === null) {
+                        res.writeHead(413, { 'Content-Type': 'text/plain' });
+                        res.end('Payload Too Large');
+                        return;
+                    }
+                    body = collected;
+                }
+                const request = new Request(url, {
+                    method: (_c = req.method) !== null && _c !== void 0 ? _c : 'GET',
+                    headers: headers,
+                    body: body !== null && body !== void 0 ? body : null,
+                });
+                const response = yield fetchHandler(request);
+                // Write response back to Node.js ServerResponse.
+                const responseHeaders = {};
+                response.headers.forEach((value, key) => { responseHeaders[key] = value; });
+                res.writeHead(response.status, responseHeaders);
+                if (response.body) {
+                    const reader = response.body.getReader();
+                    try {
+                        while (true) {
+                            const { done, value } = yield reader.read();
+                            if (done) {
+                                break;
+                            }
+                            res.write(value);
+                        }
+                    }
+                    finally {
+                        reader.releaseLock();
+                    }
+                }
+                res.end();
+            }
+            catch (err) {
+                console.error(`Git HTTP handler error: ${err.message}`);
+                res.writeHead(500);
+                res.end('Internal Server Error');
+            }
+        }));
+        // Start listening.
+        const actualPort = yield new Promise((resolve) => {
+            server.listen(port, hostname, () => {
+                const addr = server.address();
+                const boundPort = typeof addr === 'object' && addr !== null ? addr.port : port;
+                resolve(boundPort);
+            });
+        });
+        return {
+            port: actualPort,
+            backend: backend,
+            stop() {
+                return __awaiter(this, void 0, void 0, function* () {
+                    return new Promise((resolve, reject) => {
+                        server.close((err) => {
+                            if (err) {
+                                reject(err);
+                            }
+                            else {
+                                resolve();
+                            }
+                        });
+                    });
+                });
+            },
+        };
+    });
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Collect the full request body from a Node.js IncomingMessage.
+ * Returns `null` if the body exceeds `maxBytes`.
+ */
+function collectRequestBody(req, maxBytes = DEFAULT_MAX_BODY_GIT) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let totalSize = 0;
+        let exceeded = false;
+        req.on('data', (chunk) => {
+            if (exceeded) {
+                return;
+            }
+            totalSize += chunk.length;
+            if (totalSize > maxBytes) {
+                exceeded = true;
+                // Stop reading but don't destroy — let the response be sent.
+                req.resume();
+                resolve(null);
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            if (!exceeded) {
+                resolve(new Uint8Array(Buffer.concat(chunks)));
+            }
+        });
+        req.on('error', () => {
+            if (!exceeded) {
+                resolve(null);
+            }
+        });
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/esm/git-server/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/git-server/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAsD9C,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAgB,eAAe,CAAC,OAAyB;;QAC7D,MAAM,EACJ,QAAQ,EACR,IAAI,GAAG,IAAI,EACX,QAAQ,GAAG,SAAS,EACpB,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,GAAG,oBAAoB,GACnC,GAAG,OAAO,CAAC;QAEZ,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE7C,MAAM,YAAY,GAAG,oBAAoB,CAAC;YACxC,OAAO;YACP,UAAU;YACV,gBAAgB;YAChB,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAO,GAAG,EAAE,GAAG,EAAE,EAAE;;YAC7C,yBAAyB;YACzB,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,MAAM,GAAG,GAAG,UAAU,MAAA,GAAG,CAAC,OAAO,CAAC,IAAI,mCAAI,WAAW,GAAG,MAAA,GAAG,CAAC,GAAG,mCAAI,GAAG,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvD,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;gBAED,iDAAiD;gBACjD,IAAI,IAA4B,CAAC;gBACjC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;oBAC7D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;wBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;wBACrD,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,IAAI,GAAG,SAAS,CAAC;gBACnB,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;oBAC/B,MAAM,EAAI,MAAA,GAAG,CAAC,MAAM,mCAAI,KAAK;oBAC7B,OAAO,EAAG,OAAO;oBACjB,IAAI,EAAM,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI;iBACvB,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;gBAE7C,iDAAiD;gBACjD,MAAM,eAAe,GAA2B,EAAE,CAAC;gBACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBAChD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACzC,IAAI,CAAC;wBACH,OAAO,IAAI,EAAE,CAAC;4BACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,IAAI,IAAI,EAAE,CAAC;gCAAC,MAAM;4BAAC,CAAC;4BACpB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACnB,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAA,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC/E,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAM,UAAU;YACpB,OAAO,EAAG,OAAO;YACX,IAAI;;oBACR,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;wBACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;4BACnB,IAAI,GAAG,EAAE,CAAC;gCAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAAC,CAAC;iCAAM,CAAC;gCAAC,OAAO,EAAE,CAAC;4BAAC,CAAC;wBAC/C,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC;aAAA;SACF,CAAC;IACJ,CAAC;CAAA;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAoB,EAAE,WAAmB,oBAAoB;IACvF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC;gBAChB,6DAA6D;gBAC7D,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/git-server/verify.js

@@ -0,0 +1,109 @@
+/**
+ * DID-based signature verification for push authentication.
+ *
+ * Resolves a DID document, extracts the Ed25519 authentication key,
+ * and verifies the signature. This is the production implementation
+ * of the `SignatureVerifier` callback used by `createPushAuthenticator`.
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Ed25519 } from '@enbox/crypto';
+import { DidDht, DidJwk, DidKey, DidWeb, UniversalResolver } from '@enbox/dids';
+// ---------------------------------------------------------------------------
+// Resolver
+// ---------------------------------------------------------------------------
+/** Shared resolver instance (lazy-initialized). */
+let resolver;
+/** Get or create the DID resolver. */
+function getResolver() {
+    if (!resolver) {
+        resolver = new UniversalResolver({
+            didResolvers: [DidDht, DidJwk, DidWeb, DidKey],
+        });
+    }
+    return resolver;
+}
+// ---------------------------------------------------------------------------
+// Signature verifier
+// ---------------------------------------------------------------------------
+/**
+ * Create a `SignatureVerifier` that resolves a DID and verifies an Ed25519
+ * signature against the DID document's authentication verification method.
+ *
+ * The verifier looks for the first Ed25519 verification method in the DID
+ * document's `authentication` purpose (or falls back to `verificationMethod`
+ * if no authentication methods are defined).
+ *
+ * @returns A `SignatureVerifier` callback
+ */
+/** DID resolution timeout in milliseconds. */
+const DID_RESOLUTION_TIMEOUT_MS = 30000;
+export function createDidSignatureVerifier() {
+    return (did, payload, signature) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            const { didDocument, didResolutionMetadata } = yield Promise.race([
+                getResolver().resolve(did),
+                new Promise((_, reject) => setTimeout(() => reject(new Error(`DID resolution timed out for ${did}`)), DID_RESOLUTION_TIMEOUT_MS)),
+            ]);
+            if (didResolutionMetadata.error || !didDocument) {
+                return false;
+            }
+            // Find an Ed25519 public key from the authentication verification methods.
+            const publicKeyJwk = findEd25519AuthKey(didDocument);
+            if (!publicKeyJwk) {
+                return false;
+            }
+            return yield Ed25519.verify({
+                key: publicKeyJwk,
+                data: payload,
+                signature: signature,
+            });
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Find the first Ed25519 public key JWK from a DID document's authentication
+ * verification methods.
+ */
+function findEd25519AuthKey(didDocument) {
+    var _a, _b;
+    const methods = (_a = didDocument.verificationMethod) !== null && _a !== void 0 ? _a : [];
+    // If authentication references exist, filter to those methods.
+    const authRefs = (_b = didDocument.authentication) !== null && _b !== void 0 ? _b : [];
+    const authMethodIds = new Set();
+    for (const ref of authRefs) {
+        if (typeof ref === 'string') {
+            authMethodIds.add(ref);
+        }
+        else if (ref === null || ref === void 0 ? void 0 : ref.id) {
+            authMethodIds.add(ref.id);
+        }
+    }
+    // Prefer authentication methods; fall back to all verification methods.
+    const candidates = authMethodIds.size > 0
+        ? methods.filter((m) => authMethodIds.has(m.id))
+        : methods;
+    for (const method of candidates) {
+        const jwk = method.publicKeyJwk;
+        if (jwk && jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && jwk.x) {
+            return jwk;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=verify.js.map

package/dist/esm/git-server/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/git-server/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,mDAAmD;AACnD,IAAI,QAAuC,CAAC;AAE5C,sCAAsC;AACtC,SAAS,WAAW;IAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YAC/B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,KAAM,CAAC;AAEzC,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAO,GAAW,EAAE,OAAmB,EAAE,SAAqB,EAAoB,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,qBAAqB,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChE,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;gBAC1B,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,CAAC,CACtG;aACF,CAAC,CAAC;YAEH,IAAI,qBAAqB,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,2EAA2E;YAC3E,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC;gBAC1B,GAAG,EAAS,YAAY;gBACxB,IAAI,EAAQ,OAAO;gBACnB,SAAS,EAAG,SAAS;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,WAAmE;;IAC7F,MAAM,OAAO,GAAG,MAAA,WAAW,CAAC,kBAAkB,mCAAI,EAAE,CAAC;IAErD,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,MAAA,WAAW,CAAC,cAAc,mCAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,EAAE,EAAE,CAAC;YACnB,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,OAAO,CAAC;IAEZ,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}