@enbox/gitd 0.0.1

package/dist/types/daemon/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/daemon/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAOjD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,WAAW,EAKjD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAE/D"}

package/dist/types/daemon/adapters/npm.d.ts

@@ -0,0 +1,10 @@
+/**
+ * npm registry shim adapter for the unified daemon.
+ *
+ * Wraps `handleNpmRequest()` behind the `ShimAdapter` interface.
+ *
+ * @module
+ */
+import type { ShimAdapter } from '../adapter.js';
+export declare const npmAdapter: ShimAdapter;
+//# sourceMappingURL=npm.d.ts.map

package/dist/types/daemon/adapters/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../../../src/daemon/adapters/npm.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAQjD,eAAO,MAAM,UAAU,EAAE,WA2BxB,CAAC"}

package/dist/types/daemon/adapters/oci.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OCI/Docker registry shim adapter for the unified daemon.
+ *
+ * Wraps `handleOciRequest()` behind the `ShimAdapter` interface.
+ *
+ * @module
+ */
+import type { ShimAdapter } from '../adapter.js';
+export declare const ociAdapter: ShimAdapter;
+//# sourceMappingURL=oci.d.ts.map

package/dist/types/daemon/adapters/oci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../../src/daemon/adapters/oci.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAQjD,eAAO,MAAM,UAAU,EAAE,WAuCxB,CAAC"}

package/dist/types/daemon/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Unified daemon — barrel exports.
+ *
+ * @module
+ */
+export type { DaemonConfig, ResolvedShimConfig, ShimAdapter, ShimConfig } from './adapter.js';
+export type { DaemonInstance, DaemonOptions } from './server.js';
+export { createAdapterServer, resolveConfig, startDaemon } from './server.js';
+export { builtinAdapters, findAdapter } from './adapters/index.js';
+export { githubAdapter } from './adapters/github.js';
+export { goAdapter } from './adapters/go.js';
+export { npmAdapter } from './adapters/npm.js';
+export { ociAdapter } from './adapters/oci.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/daemon/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/daemon/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/types/daemon/server.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Unified daemon server — starts one HTTP server per enabled shim adapter.
+ *
+ * The daemon manages the lifecycle of all shim servers from a single
+ * process.  It resolves configuration (JSON file, env vars, defaults),
+ * starts each enabled adapter on its assigned port, logs a status
+ * summary, and handles graceful shutdown on SIGINT/SIGTERM.
+ *
+ * Each adapter's server includes:
+ *   - CORS preflight handling (OPTIONS)
+ *   - A `/health` endpoint returning `{ status: 'ok', shim: '<id>' }`
+ *   - Delegation to the adapter's `handle()` method for all other requests
+ *   - Top-level error catching with 500 responses
+ *
+ * @module
+ */
+import type { Server } from 'node:http';
+import type { AgentContext } from '../cli/agent.js';
+import type { DaemonConfig, ResolvedShimConfig, ShimAdapter } from './adapter.js';
+export type DaemonOptions = {
+    ctx: AgentContext;
+    config: DaemonConfig;
+};
+export type DaemonInstance = {
+    /** All running HTTP servers keyed by adapter id. */
+    servers: Map<string, Server>;
+    /** The resolved config for each adapter. */
+    resolved: ResolvedShimConfig[];
+    /** Gracefully shut down all servers. */
+    stop(): Promise<void>;
+};
+/**
+ * Resolve the effective configuration for every known adapter.
+ *
+ * Priority for port: config file > env var > adapter default.
+ * Priority for enabled: config file > `true` (all enabled by default).
+ */
+export declare function resolveConfig(config: DaemonConfig, adapters?: readonly ShimAdapter[]): ResolvedShimConfig[];
+/**
+ * Create an HTTP server for a single adapter.
+ *
+ * The server handles CORS preflight, `/health`, and delegates
+ * everything else to the adapter.  It does NOT call `server.listen()`
+ * — the caller is responsible for that.
+ */
+export declare function createAdapterServer(ctx: AgentContext, adapter: ShimAdapter): Server;
+/**
+ * Start the unified daemon.
+ *
+ * Resolves configuration, starts one HTTP server per enabled adapter,
+ * registers SIGINT/SIGTERM handlers, and returns the `DaemonInstance`
+ * for programmatic control and testing.
+ */
+export declare function startDaemon(options: DaemonOptions): Promise<DaemonInstance>;
+//# sourceMappingURL=server.d.ts.map

package/dist/types/daemon/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/daemon/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAIxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAQlF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAG,YAAY,CAAC;IACnB,MAAM,EAAG,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,oDAAoD;IACpD,OAAO,EAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9B,4CAA4C;IAC5C,QAAQ,EAAG,kBAAkB,EAAE,CAAC;IAEhC,wCAAwC;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AAMF;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,QAAQ,GAAE,SAAS,WAAW,EAAoB,GACjD,kBAAkB,EAAE,CActB;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAqCnF;AAMD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAmEjF"}

package/dist/types/git-remote/credential-helper.d.ts

@@ -0,0 +1,49 @@
+#!/usr/bin/env bun
+/**
+ * Git credential helper for DID-based push authentication.
+ *
+ * Git invokes credential helpers with a single argument: `get`, `store`, or
+ * `erase`. For `get`, the helper reads the request from stdin and writes
+ * credentials to stdout.
+ *
+ * This helper creates a DID-signed push token using the local Web5 agent's
+ * identity, formatted as HTTP Basic auth credentials:
+ *   username: did-auth
+ *   password: <base64url-signature>.<base64url-token>
+ *
+ * Usage in .gitconfig:
+ *   [credential "https://git.example.com"]
+ *     helper = /path/to/gitd-credential-helper
+ *
+ * Environment:
+ *   GITD_PASSWORD — vault password for the local agent
+ *
+ * @module
+ */
+/** Parsed credential request from git. */
+type CredentialRequest = {
+    protocol?: string;
+    host?: string;
+    path?: string;
+};
+/**
+ * Generate push credentials for a git request.
+ *
+ * @param request - The parsed credential request from git
+ * @param agentDid - The local agent's DID
+ * @param privateKeyJwk - The agent's Ed25519 private key (JWK)
+ * @returns The credential response to write to stdout, or undefined if not applicable
+ */
+export declare function generatePushCredentials(request: CredentialRequest, agentDid: string, privateKeyJwk: Record<string, unknown>): Promise<{
+    username: string;
+    password: string;
+} | undefined>;
+/** Parse a git credential helper request from stdin lines. */
+export declare function parseCredentialRequest(input: string): CredentialRequest;
+/** Format a credential response for git. */
+export declare function formatCredentialResponse(creds: {
+    username: string;
+    password: string;
+}): string;
+export {};
+//# sourceMappingURL=credential-helper.d.ts.map

package/dist/types/git-remote/credential-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-helper.d.ts","sourceRoot":"","sources":["../../../src/git-remote/credential-helper.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;GAoBG;AAeH,0CAA0C;AAC1C,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAMF;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA8B7D;AAMD,8DAA8D;AAC9D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAYvE;AAED,4CAA4C;AAC5C,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE9F"}

package/dist/types/git-remote/credential-main.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env bun
+/**
+ * Git credential helper entry point for DID-based push authentication.
+ *
+ * Git invokes this binary with a single argument: `get`, `store`, or `erase`.
+ * For `get`, the helper reads the request from stdin (key=value lines) and
+ * writes credentials to stdout.
+ *
+ * This helper creates a DID-signed push token using the local Web5 agent's
+ * identity, formatted as HTTP Basic auth credentials:
+ *   username: did-auth
+ *   password: <base64url-signature>.<base64url-token>
+ *
+ * Install in .gitconfig:
+ *   [credential]
+ *     helper = /path/to/git-remote-did-credential
+ *
+ * Environment:
+ *   GITD_PASSWORD — vault password for the local agent
+ *
+ * @module
+ */
+export {};
+//# sourceMappingURL=credential-main.d.ts.map

package/dist/types/git-remote/credential-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-main.d.ts","sourceRoot":"","sources":["../../../src/git-remote/credential-main.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;GAoBG"}

package/dist/types/git-remote/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Git remote helper — DID-based remote transport for git.
+ *
+ * @module git-remote
+ */
+export * from './credential-helper.js';
+export * from './parse-url.js';
+export * from './resolve.js';
+export * from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/git-remote/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/git-remote/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/types/git-remote/main.d.ts

@@ -0,0 +1,23 @@
+#!/usr/bin/env bun
+/**
+ * git-remote-did — Git remote helper for DID-addressed repositories.
+ *
+ * This helper is invoked by Git when it encounters a `did::` or `did://`
+ * remote URL.  It resolves the DID to an HTTPS endpoint and delegates all
+ * git transport to `git-remote-https`.
+ *
+ * Usage (invoked by Git, not directly):
+ *   git clone did::dht:abc123/my-repo
+ *   git remote add origin did::dht:abc123/my-repo
+ *   git push origin main
+ *
+ * The helper:
+ *   1. Parses the DID from the URL
+ *   2. Resolves the DID document
+ *   3. Extracts the GitTransport or DWN service endpoint
+ *   4. Execs `git-remote-https` with the resolved HTTPS URL
+ *
+ * @module
+ */
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/types/git-remote/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../../src/git-remote/main.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/types/git-remote/parse-url.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Parse DID URLs used with `git-remote-did`.
+ *
+ * Supported URL forms (all invoke `git-remote-did <remote> <url>`):
+ *
+ *   did::dht:abc123                → DID = did:dht:abc123, repo = undefined
+ *   did::dht:abc123/my-repo       → DID = did:dht:abc123, repo = my-repo
+ *   did://dht:abc123/my-repo      → DID = did:dht:abc123, repo = my-repo
+ *
+ * The double-colon form (`did::<address>`) is recommended because it avoids
+ * URL-parsing ambiguity.  Git strips the `did::` prefix and passes
+ * `<address>` as the URL argument.
+ *
+ * @module
+ */
+/** Parsed components of a DID remote URL. */
+export type ParsedDidUrl = {
+    /** Full DID URI, e.g. `did:dht:abc123xyz`. */
+    did: string;
+    /** Optional repository name from the path component. */
+    repo?: string;
+};
+/**
+ * Parse a DID remote URL into its components.
+ *
+ * @param url - The URL argument passed by Git to the remote helper.
+ *              After stripping the transport prefix:
+ *                `did::dht:abc123/repo` → Git passes `dht:abc123/repo`
+ *                `did://dht:abc123/repo` → Git passes `did://dht:abc123/repo`
+ */
+export declare function parseDidUrl(url: string): ParsedDidUrl;
+//# sourceMappingURL=parse-url.d.ts.map

package/dist/types/git-remote/parse-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-url.d.ts","sourceRoot":"","sources":["../../../src/git-remote/parse-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG;IACzB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IAEZ,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAMF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAuCrD"}

package/dist/types/git-remote/resolve.d.ts

@@ -0,0 +1,30 @@
+/**
+ * DID resolution and git transport endpoint discovery.
+ *
+ * Resolves a DID document and extracts the git transport endpoint URL.
+ * The resolution order is:
+ *   1. Service of type `GitTransport` (preferred)
+ *   2. Service of type `DecentralizedWebNode` with `/git` suffix appended
+ *   3. Failure — no git endpoint found
+ *
+ * @module
+ */
+/** Result of resolving a DID to a git transport endpoint. */
+export type GitEndpoint = {
+    /** The resolved HTTPS URL for git smart HTTP transport. */
+    url: string;
+    /** The DID that was resolved. */
+    did: string;
+    /** How the endpoint was discovered. */
+    source: 'GitTransport' | 'DecentralizedWebNode';
+};
+/**
+ * Resolve a DID to a git transport HTTPS endpoint.
+ *
+ * @param did - Full DID URI (e.g. `did:dht:abc123xyz`)
+ * @param repo - Optional repo name to append to the endpoint path
+ * @returns The resolved git transport endpoint
+ * @throws If resolution fails, times out, or no git-compatible service is found
+ */
+export declare function resolveGitEndpoint(did: string, repo?: string): Promise<GitEndpoint>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/types/git-remote/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/git-remote/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,6DAA6D;AAC7D,MAAM,MAAM,WAAW,GAAG;IACxB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IAEZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IAEZ,uCAAuC;IACvC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CAAC;CACjD,CAAC;AAsBF;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA6CzF"}

package/dist/types/git-remote/service.d.ts

@@ -0,0 +1,75 @@
+/**
+ * GitTransport DID service type utilities.
+ *
+ * Provides helpers for creating and identifying `GitTransport` service entries
+ * in DID documents.  The `GitTransport` service type advertises a smart HTTP
+ * git endpoint that can be used by `git-remote-did` to locate repositories.
+ *
+ * When a DID document contains a GitTransport service, the git remote helper
+ * uses it directly (highest priority).  Otherwise it falls back to
+ * `DecentralizedWebNode` + `/git` suffix.
+ *
+ * @example
+ * ```ts
+ * import { createGitTransportService } from '@enbox/gitd/git-remote/service';
+ *
+ * const service = createGitTransportService({
+ *   id              : '#git',
+ *   serviceEndpoint : 'https://git.example.com',
+ * });
+ * // → { id: '#git', type: 'GitTransport', serviceEndpoint: 'https://git.example.com' }
+ * ```
+ *
+ * @module
+ */
+import type { DidDocument, DidService } from '@enbox/dids';
+/** The DID service type string for git smart HTTP transport endpoints. */
+export declare const GIT_TRANSPORT_SERVICE_TYPE: "GitTransport";
+/**
+ * A DID service entry with `type` fixed to `GitTransport`.
+ *
+ * The `serviceEndpoint` should be an HTTPS URL (or array of URLs) pointing to
+ * a smart HTTP git server.  Repositories are addressed by appending the repo
+ * name as a path segment: `<serviceEndpoint>/<repo-name>`.
+ */
+export interface GitTransportService extends DidService {
+    type: typeof GIT_TRANSPORT_SERVICE_TYPE;
+}
+/** Options for creating a GitTransport service entry. */
+export type CreateGitTransportServiceOptions = {
+    /**
+     * The service entry `id`, typically a fragment like `#git`.
+     * If no `#` prefix is provided, it will be added automatically.
+     */
+    id: string;
+    /**
+     * The HTTPS URL (or URLs) of the git smart HTTP endpoint.
+     *
+     * @example 'https://git.example.com'
+     * @example ['https://git1.example.com', 'https://git2.example.com']
+     */
+    serviceEndpoint: string | string[];
+};
+/**
+ * Create a `GitTransport` DID service entry.
+ *
+ * @param options - Service configuration
+ * @returns A well-formed GitTransport service entry ready for inclusion in a
+ *          DID document's `service` array.
+ */
+export declare function createGitTransportService(options: CreateGitTransportServiceOptions): GitTransportService;
+/**
+ * Check whether a DID service entry is a GitTransport service.
+ *
+ * @param service - A service entry from a DID document
+ * @returns `true` if the service type is `GitTransport`
+ */
+export declare function isGitTransportService(service: DidService): service is GitTransportService;
+/**
+ * Extract all GitTransport service entries from a DID document.
+ *
+ * @param didDocument - A resolved DID document
+ * @returns An array of GitTransport services (may be empty)
+ */
+export declare function getGitTransportServices(didDocument: DidDocument): GitTransportService[];
+//# sourceMappingURL=service.d.ts.map

package/dist/types/git-remote/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/git-remote/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAM3D,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,gBAA0B,CAAC;AAMlE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,OAAO,0BAA0B,CAAC;CACzC;AAED,yDAAyD;AACzD,MAAM,MAAM,gCAAgC,GAAG;IAC7C;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;;;;OAKG;IACH,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACpC,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gCAAgC,GACxC,mBAAmB,CAsBrB;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,IAAI,mBAAmB,CAEzF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,WAAW,GAAG,mBAAmB,EAAE,CAEvF"}

package/dist/types/git-server/auth.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Push authentication for the git transport sidecar.
+ *
+ * Implements a DID-based authentication scheme for git push operations.
+ * The scheme uses signed tokens that prove DID ownership:
+ *
+ * 1. The client generates a token: `base64url(JSON({ did, repo, exp, nonce }))`
+ * 2. The client signs the token with their DID's Ed25519 key
+ * 3. The client sends the token + signature as HTTP Basic auth credentials:
+ *    - username: `did-auth` (fixed; DIDs contain colons so can't be usernames)
+ *    - password: `<base64url-signature>.<base64url-token>`
+ * 4. The server verifies the signature using the DID document's
+ *    authentication verification method
+ *
+ * This approach works with git's native credential helper system — no custom
+ * transport modifications required.
+ *
+ * @module
+ */
+/**
+ * Fixed username for HTTP Basic auth.
+ * DIDs contain colons which conflict with HTTP Basic auth's username:password
+ * separator, so we use a fixed username and embed the DID in the token payload.
+ */
+export declare const DID_AUTH_USERNAME = "did-auth";
+/** The payload inside a signed push token. */
+export type PushTokenPayload = {
+    /** The DID of the pusher. */
+    did: string;
+    /** The repository owner's DID. */
+    owner: string;
+    /** The repository name. */
+    repo: string;
+    /** Token expiration timestamp (seconds since epoch). */
+    exp: number;
+    /** Random nonce to prevent replay. */
+    nonce: string;
+};
+/** A signed push token (token + signature). */
+export type SignedPushToken = {
+    /** The base64url-encoded token payload. */
+    token: string;
+    /** The base64url-encoded Ed25519 signature over the token. */
+    signature: string;
+};
+/**
+ * Verification callback that resolves a DID, extracts the Ed25519 public key,
+ * and verifies the signature.
+ *
+ * @param did - The DID that claims to have signed the token
+ * @param payload - The raw token bytes that were signed
+ * @param signature - The signature bytes to verify
+ * @returns `true` if the signature is valid for the DID's authentication key
+ */
+export type SignatureVerifier = (did: string, payload: Uint8Array, signature: Uint8Array) => Promise<boolean>;
+/**
+ * Authorization callback that checks whether a DID has push access to a repo.
+ * This typically queries the DWN for a `repo/maintainer` role record.
+ *
+ * @param did - The authenticated pusher's DID
+ * @param owner - The repository owner's DID
+ * @param repo - The repository name
+ * @returns `true` if the DID is authorized to push
+ */
+export type PushAuthorizer = (did: string, owner: string, repo: string) => Promise<boolean>;
+/** Options for creating a push authenticator. */
+export type PushAuthenticatorOptions = {
+    /** Callback to verify Ed25519 signatures against a DID document. */
+    verifySignature: SignatureVerifier;
+    /**
+     * Optional callback to check push authorization (role-based access).
+     * If not provided, any authenticated DID is allowed to push.
+     */
+    authorizePush?: PushAuthorizer;
+    /** Maximum token age in seconds. @default 300 (5 minutes) */
+    maxTokenAge?: number;
+};
+/**
+ * Create a push token payload.
+ *
+ * @param did - The pusher's DID
+ * @param owner - The repository owner's DID
+ * @param repo - The repository name
+ * @param ttlSeconds - Token lifetime in seconds (default: 300)
+ * @returns The token payload
+ */
+export declare function createPushTokenPayload(did: string, owner: string, repo: string, ttlSeconds?: number): PushTokenPayload;
+/**
+ * Encode a push token payload as a base64url string.
+ *
+ * @param payload - The token payload
+ * @returns base64url-encoded JSON
+ */
+export declare function encodePushToken(payload: PushTokenPayload): string;
+/**
+ * Decode a base64url push token string back to a payload.
+ *
+ * @param token - The base64url-encoded token
+ * @returns The decoded payload
+ * @throws If the token is malformed
+ */
+export declare function decodePushToken(token: string): PushTokenPayload;
+/**
+ * Format a signed push token for use as an HTTP Basic auth password.
+ * The format is `<base64url-signature>.<base64url-token>`.
+ *
+ * @param signed - The signed token
+ * @returns The formatted password string
+ */
+export declare function formatAuthPassword(signed: SignedPushToken): string;
+/**
+ * Parse an HTTP Basic auth password back into a signed push token.
+ *
+ * @param password - The password from HTTP Basic auth
+ * @returns The parsed signed token
+ * @throws If the format is invalid
+ */
+export declare function parseAuthPassword(password: string): SignedPushToken;
+/**
+ * Create an `authenticatePush` callback for use with `createGitHttpHandler`.
+ *
+ * Extracts HTTP Basic credentials from the request, verifies the signed token,
+ * and optionally checks role-based authorization.
+ *
+ * @param options - Authenticator configuration
+ * @returns An authenticatePush callback
+ */
+export declare function createPushAuthenticator(options: PushAuthenticatorOptions): (request: Request, did: string, repo: string) => Promise<boolean>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/types/git-server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/git-server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAM5C,8CAA8C;AAC9C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;IAEZ,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IAEd,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IAEb,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IAEZ,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IAEd,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,KAClB,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,iDAAiD;AACjD,MAAM,MAAM,wBAAwB,GAAG;IACrC,oEAAoE;IACpE,eAAe,EAAE,iBAAiB,CAAC;IAEnC;;;OAGG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAE/B,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAMF;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAY,GACvB,gBAAgB,CAQlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAGjE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAa/D;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CASnE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,wBAAwB,GAChC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CA6FnE"}

package/dist/types/git-server/bundle-restore.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Bundle restore — reconstructs a bare git repo from DWN bundle records.
+ *
+ * When a commodity git host receives a clone request for a repo it doesn't
+ * have on disk, it resolves the owner's DID, reads bundle records from
+ * the owner's DWN, and reconstructs the bare repo locally.
+ *
+ * Restore flow:
+ * 1. Query the owner's DWN for bundle records (via the repo's contextId)
+ * 2. Find the most recent full bundle (isFull: true)
+ * 3. Clone from the full bundle to create a bare repo
+ * 4. Apply any incremental bundles (in chronological order) that are newer
+ * 5. The restored repo is now ready to serve clones and accept pushes
+ *
+ * @module
+ */
+import type { ForgeRepoProtocol } from '../repo.js';
+import type { ForgeRepoSchemaMap } from '../repo.js';
+import type { TypedWeb5 } from '@enbox/api';
+/** Options for restoring a repository from DWN bundles. */
+export type BundleRestoreOptions = {
+    /** The typed ForgeRepoProtocol Web5 handle for the owner's DWN. */
+    repo: TypedWeb5<typeof ForgeRepoProtocol.definition, ForgeRepoSchemaMap>;
+    /** Path where the bare repository should be created. */
+    repoPath: string;
+};
+/** Result of a bundle restore operation. */
+export type BundleRestoreResult = {
+    /** Whether the restore succeeded. */
+    success: boolean;
+    /** Number of bundles applied (1 full + N incrementals). */
+    bundlesApplied: number;
+    /** The tip commit SHA after restore. */
+    tipCommit?: string;
+    /** Error message if restore failed. */
+    error?: string;
+};
+/**
+ * Restore a bare git repository from DWN bundle records.
+ *
+ * Queries the owner's DWN for bundle records, downloads the most recent
+ * full bundle, clones from it, then applies any incremental bundles.
+ *
+ * @param options - Restore configuration
+ * @returns Result of the restore operation
+ */
+export declare function restoreFromBundles(options: BundleRestoreOptions): Promise<BundleRestoreResult>;
+//# sourceMappingURL=bundle-restore.d.ts.map

package/dist/types/git-server/bundle-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-restore.d.ts","sourceRoot":"","sources":["../../../src/git-server/bundle-restore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAa5C,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG;IACjC,mEAAmE;IACnE,IAAI,EAAE,SAAS,CAAC,OAAO,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAEzE,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,4CAA4C;AAC5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IAEjB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC;IAEvB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAMF;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAqE9B"}