@enbox/gitd 0.0.1

package/dist/types/git-server/bundle-sync.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Git bundle → DWN sync — creates/updates a git bundle as a DWN record.
+ *
+ * After a successful `git push`, this module generates a `git bundle` from
+ * the bare repository and writes it as a ForgeRepo `bundle` record.
+ * Incremental bundles are created when a previous bundle exists; periodic
+ * squash writes compact all incrementals into a single full bundle.
+ *
+ * Bundle sync flow:
+ * 1. Query existing bundle records for the repo (sorted by timestamp desc)
+ * 2. If no bundles exist → create full bundle (`git bundle create --all`)
+ * 3. If bundles exist → create incremental bundle since last tip commit
+ * 4. Every N pushes (configurable), create a squash bundle (full bundle
+ *    with `squash: true`) which purges all older bundle records
+ *
+ * The bundle data (binary `application/x-git-bundle`) is stored as the
+ * record payload. Queryable metadata is stored in tags.
+ *
+ * @module
+ */
+import type { ForgeRepoProtocol } from '../repo.js';
+import type { ForgeRepoSchemaMap } from '../repo.js';
+import type { OnPushComplete } from './ref-sync.js';
+import type { TypedWeb5 } from '@enbox/api';
+/** Options for creating a bundle syncer. */
+export type BundleSyncOptions = {
+    /** The typed ForgeRepoProtocol Web5 handle. */
+    repo: TypedWeb5<typeof ForgeRepoProtocol.definition, ForgeRepoSchemaMap>;
+    /** The repo's contextId (from the ForgeRepoProtocol repo record). */
+    repoContextId: string;
+    /**
+     * Repo visibility — controls whether bundle records are encrypted.
+     *
+     * - `'private'` → bundles are JWE-encrypted (only key-holders can read)
+     * - `'public'`  → bundles are plaintext (IPFS-friendly, globally readable)
+     *
+     * The protocol must be installed with `encryption: true` for private repos
+     * to work (this injects `$encryption` keys on all protocol paths).
+     *
+     * @default 'public'
+     */
+    visibility?: 'public' | 'private';
+    /**
+     * Number of incremental bundles to accumulate before squashing.
+     * When this threshold is reached, the next bundle write is a squash
+     * that replaces all older bundles with a single full bundle.
+     *
+     * @default 5
+     */
+    squashThreshold?: number;
+};
+/** Metadata about a generated git bundle. */
+export type BundleInfo = {
+    /** Path to the bundle file on disk. */
+    path: string;
+    /** SHA of the tip commit (HEAD of default branch). */
+    tipCommit: string;
+    /** Whether this is a full bundle (all refs) or incremental. */
+    isFull: boolean;
+    /** Number of refs included in the bundle. */
+    refCount: number;
+    /** File size in bytes. */
+    size: number;
+};
+/**
+ * Create an `onPushComplete` callback that syncs a git bundle to a DWN record.
+ *
+ * @param options - Bundle sync configuration
+ * @returns An async callback to invoke after a successful push
+ */
+export declare function createBundleSyncer(options: BundleSyncOptions): OnPushComplete;
+/**
+ * Create a full git bundle containing all refs and all reachable objects.
+ *
+ * @param repoPath - Path to the bare git repository
+ * @returns Bundle metadata and file path
+ */
+export declare function createFullBundle(repoPath: string): Promise<BundleInfo>;
+/**
+ * Create an incremental git bundle containing only objects since a base commit.
+ *
+ * The bundle uses the base commit as a prerequisite, meaning the consumer
+ * must already have it to apply the incremental bundle.
+ *
+ * @param repoPath - Path to the bare git repository
+ * @param baseCommit - The commit SHA to use as the prerequisite (exclude point)
+ * @returns Bundle metadata and file path
+ */
+export declare function createIncrementalBundle(repoPath: string, baseCommit: string): Promise<BundleInfo>;
+//# sourceMappingURL=bundle-sync.d.ts.map

package/dist/types/git-server/bundle-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-sync.d.ts","sourceRoot":"","sources":["../../../src/git-server/bundle-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAY5C,4CAA4C;AAC5C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,+CAA+C;IAC/C,IAAI,EAAE,SAAS,CAAC,OAAO,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAEzE,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAElC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,UAAU,GAAG;IACvB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,MAAM,EAAE,OAAO,CAAC;IAChB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAMF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,cAAc,CA2E7E;AAMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB5E;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}

package/dist/types/git-server/did-service.d.ts

@@ -0,0 +1,26 @@
+/**
+ * DID document service management for git transport.
+ *
+ * Adds or updates a `GitTransport` service entry in a DID document,
+ * advertising the git smart HTTP endpoint for the `git-remote-did` helper.
+ *
+ * This module works with the agent's DID API to persist and publish
+ * service updates. For `did:dht`, the updated document is republished
+ * to the DHT network.
+ *
+ * @module
+ */
+import type { Web5 } from '@enbox/api';
+/**
+ * Register a GitTransport service endpoint in the agent's DID document.
+ *
+ * If a GitTransport service already exists, its endpoint is updated.
+ * Otherwise, a new service entry is created. The updated DID document
+ * is persisted in the agent store and (for did:dht) republished.
+ *
+ * @param web5 - The Web5 instance (provides agent DID and did API)
+ * @param endpoint - The git transport HTTPS URL (e.g. `https://git.example.com`)
+ * @throws If the agent does not support DID updates
+ */
+export declare function registerGitService(web5: Web5, endpoint: string): Promise<void>;
+//# sourceMappingURL=did-service.d.ts.map

package/dist/types/git-server/did-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-service.d.ts","sourceRoot":"","sources":["../../../src/git-server/did-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAevC;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCpF"}

package/dist/types/git-server/git-backend.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Git backend — wraps Git CLI commands for bare repository management.
+ *
+ * Provides a thin abstraction over `git init --bare`, `git upload-pack`, and
+ * `git receive-pack` for use by the smart HTTP transport handler.
+ *
+ * All repositories are stored as bare repos under a configurable base
+ * directory, organized by DID:  `<basePath>/<did-hash>/<repo-name>.git`
+ *
+ * @module
+ */
+/** Options for creating a GitBackend instance. */
+export type GitBackendOptions = {
+    /**
+     * Base directory for storing bare repositories.
+     * Repos are stored as `<basePath>/<did-hash>/<repo>.git`
+     */
+    basePath: string;
+};
+/** Readable stream from a git subprocess. */
+export type GitProcess = {
+    /** The subprocess stdout (pack data). */
+    stdout: ReadableStream<Uint8Array>;
+    /** The subprocess stdin for writing request data. */
+    stdin: WritableStream<Uint8Array>;
+    /** Promise that resolves with the exit code when the process completes. */
+    exitCode: Promise<number>;
+};
+/**
+ * Manages bare git repositories on the filesystem and spawns git subprocess
+ * for smart HTTP transport.
+ */
+export declare class GitBackend {
+    private readonly _basePath;
+    constructor(options: GitBackendOptions);
+    /** Get the base path for all repositories. */
+    get basePath(): string;
+    /**
+     * Compute the filesystem path for a repository.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns Absolute path to the bare repo directory
+     * @throws If the repo name contains path traversal characters
+     */
+    repoPath(did: string, repo: string): string;
+    /**
+     * Check whether a repository exists on disk.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     */
+    exists(did: string, repo: string): boolean;
+    /**
+     * Initialize a new bare repository.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns The path to the new bare repository
+     * @throws If `git init --bare` fails
+     */
+    initRepo(did: string, repo: string): Promise<string>;
+    /**
+     * Spawn `git upload-pack` for fetch/clone operations.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns A GitProcess with stdin/stdout streams for the subprocess
+     * @throws If the repository does not exist
+     */
+    uploadPack(did: string, repo: string): GitProcess;
+    /**
+     * Spawn `git receive-pack` for push operations.
+     *
+     * @param did - The DID of the repository owner
+     * @param repo - The repository name
+     * @returns A GitProcess with stdin/stdout streams for the subprocess
+     * @throws If the repository does not exist
+     */
+    receivePack(did: string, repo: string): GitProcess;
+    /** Throw if the repo doesn't exist on disk. */
+    private _assertRepoExists;
+}
+//# sourceMappingURL=git-backend.d.ts.map

package/dist/types/git-server/git-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-backend.d.ts","sourceRoot":"","sources":["../../../src/git-server/git-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,UAAU,GAAG;IACvB,yCAAyC;IACzC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAEnC,qDAAqD;IACrD,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAElC,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B,CAAC;AAMF;;;GAGG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEhB,OAAO,EAAE,iBAAiB;IAI7C,8CAA8C;IAC9C,IAAW,QAAQ,IAAI,MAAM,CAE5B;IAED;;;;;;;OAOG;IACI,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAYlD;;;;;OAKG;IACI,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAKjD;;;;;;;OAOG;IACU,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYjE;;;;;;;OAOG;IACI,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IAMxD;;;;;;;OAOG;IACI,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IAMzD,+CAA+C;IAC/C,OAAO,CAAC,iBAAiB;CAK1B"}

package/dist/types/git-server/http-handler.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Git smart HTTP transport handler.
+ *
+ * Implements the server side of Git's smart HTTP protocol (v1):
+ *   - `GET /<did>/<repo>/info/refs?service=git-upload-pack`  — ref discovery (clone/fetch)
+ *   - `POST /<did>/<repo>/git-upload-pack`                   — pack negotiation (clone/fetch)
+ *   - `GET /<did>/<repo>/info/refs?service=git-receive-pack` — ref discovery (push)
+ *   - `POST /<did>/<repo>/git-receive-pack`                  — receive pack (push)
+ *
+ * When `onRepoNotFound` is provided, the handler auto-restores repos from
+ * DWN bundle records on first access (cold-start). This enables commodity
+ * git hosts to serve repos they've never seen before.
+ *
+ * The handler is a pure function `(Request) => Response | Promise<Response>`
+ * suitable for use with `Bun.serve()`, `Deno.serve()`, or any fetch-compatible
+ * HTTP runtime.
+ *
+ * URL format: `/<did>/<repo>/...`
+ *   The DID is URL-encoded in the path (colons are preserved since they're
+ *   valid in path segments).
+ *
+ * @module
+ */
+import type { GitBackend } from './git-backend.js';
+/** Options for creating the git HTTP handler. */
+export type GitHttpHandlerOptions = {
+    /** The git backend for repository operations. */
+    backend: GitBackend;
+    /**
+     * Optional authentication callback for push operations.
+     * Called before `git-receive-pack` is allowed to proceed.
+     * Should return `true` if the request is authorized.
+     *
+     * @param request - The incoming HTTP request
+     * @param did - The repository owner's DID
+     * @param repo - The repository name
+     */
+    authenticatePush?: (request: Request, did: string, repo: string) => Promise<boolean>;
+    /**
+     * Optional callback invoked after a successful `git receive-pack` (push).
+     * Use this for post-push operations like syncing refs to DWN records.
+     *
+     * @param did - The repository owner's DID
+     * @param repo - The repository name
+     * @param repoPath - Filesystem path to the bare repository
+     */
+    onPushComplete?: (did: string, repo: string, repoPath: string) => Promise<void>;
+    /**
+     * Optional callback invoked when a clone/fetch request arrives for a
+     * repository that doesn't exist on disk. Implementations can restore
+     * the repo from DWN bundle records.
+     *
+     * @param did - The repository owner's DID
+     * @param repo - The repository name
+     * @param repoPath - The filesystem path where the repo should be created
+     * @returns `true` if the repo was restored successfully
+     */
+    onRepoNotFound?: (did: string, repo: string, repoPath: string) => Promise<boolean>;
+    /**
+     * Optional path prefix to strip from incoming URLs.
+     * For example, if the sidecar is mounted at `/git`, set this to `/git`.
+     * @default ''
+     */
+    pathPrefix?: string;
+};
+/**
+ * Create a fetch-compatible HTTP handler for Git smart HTTP transport.
+ *
+ * @param options - Handler configuration
+ * @returns A function that handles incoming HTTP requests
+ */
+export declare function createGitHttpHandler(options: GitHttpHandlerOptions): (request: Request) => Response | Promise<Response>;
+//# sourceMappingURL=http-handler.d.ts.map

package/dist/types/git-server/http-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-handler.d.ts","sourceRoot":"","sources":["../../../src/git-server/http-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,iDAAiD;AACjD,MAAM,MAAM,qBAAqB,GAAG;IAClC,iDAAiD;IACjD,OAAO,EAAE,UAAU,CAAC;IAEpB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAErF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhF;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnF;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,qBAAqB,GAC7B,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgHpD"}

package/dist/types/git-server/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Git transport server — smart HTTP git backend with DID-based push auth.
+ *
+ * @module git-server
+ */
+export * from './auth.js';
+export * from './bundle-restore.js';
+export * from './bundle-sync.js';
+export * from './did-service.js';
+export * from './git-backend.js';
+export * from './http-handler.js';
+export * from './push-authorizer.js';
+export * from './ref-sync.js';
+export * from './server.js';
+export * from './verify.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/git-server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/git-server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/types/git-server/push-authorizer.d.ts

@@ -0,0 +1,38 @@
+/**
+ * DWN-based push authorization — checks collaborator roles in the DWN.
+ *
+ * When a DID attempts to push to a repository, this module queries the
+ * DWN for `repo/maintainer` and `repo/contributor` role records to
+ * determine if the pusher is authorized.
+ *
+ * Authorization rules:
+ * - The repo owner (DID that owns the DWN) can always push
+ * - DIDs with a `maintainer` role record can push
+ * - DIDs with a `contributor` role record can push
+ * - All other DIDs are rejected
+ *
+ * @module
+ */
+import type { TypedWeb5 } from '@enbox/api';
+import type { ForgeRepoProtocol } from '../repo.js';
+import type { ForgeRepoSchemaMap } from '../repo.js';
+import type { PushAuthorizer } from './auth.js';
+/** Options for creating a DWN-based push authorizer. */
+export type DwnPushAuthorizerOptions = {
+    /** The typed ForgeRepoProtocol Web5 handle. */
+    repo: TypedWeb5<typeof ForgeRepoProtocol.definition, ForgeRepoSchemaMap>;
+    /** The DID of the DWN owner (server operator). */
+    ownerDid: string;
+};
+/**
+ * Create a `PushAuthorizer` that checks DWN collaborator role records.
+ *
+ * The authorizer queries the ForgeRepoProtocol for `maintainer` and
+ * `contributor` role records matching the pusher's DID. The repo owner
+ * is always authorized.
+ *
+ * @param options - Authorizer configuration
+ * @returns A PushAuthorizer callback
+ */
+export declare function createDwnPushAuthorizer(options: DwnPushAuthorizerOptions): PushAuthorizer;
+//# sourceMappingURL=push-authorizer.d.ts.map

package/dist/types/git-server/push-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-authorizer.d.ts","sourceRoot":"","sources":["../../../src/git-server/push-authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMhD,wDAAwD;AACxD,MAAM,MAAM,wBAAwB,GAAG;IACrC,+CAA+C;IAC/C,IAAI,EAAE,SAAS,CAAC,OAAO,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACzE,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAMF;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,cAAc,CA2BzF"}

package/dist/types/git-server/ref-sync.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Git ref → DWN sync — mirrors git branch/tag refs as ForgeRefs records.
+ *
+ * After a successful `git push`, this module reads the current refs from
+ * the bare repository and creates or updates corresponding DWN records
+ * using the ForgeRefsProtocol.
+ *
+ * Ref sync flow:
+ * 1. Run `git for-each-ref` on the bare repo to enumerate current refs
+ * 2. Query existing DWN ref records for the repo
+ * 3. Create new records for refs that don't exist in DWN
+ * 4. Update existing records whose target (SHA) has changed
+ * 5. Delete DWN records for refs that no longer exist in git
+ *
+ * @module
+ */
+import type { TypedWeb5 } from '@enbox/api';
+import type { ForgeRefsProtocol } from '../refs.js';
+import type { ForgeRefsSchemaMap } from '../refs.js';
+/** A git ref as read from `git for-each-ref`. */
+export type GitRef = {
+    /** Full ref name, e.g. `refs/heads/main` or `refs/tags/v1.0.0`. */
+    name: string;
+    /** The commit SHA this ref points to. */
+    target: string;
+    /** Ref type discriminator. */
+    type: 'branch' | 'tag';
+};
+/** Options for syncing refs. */
+export type RefSyncOptions = {
+    /** The typed ForgeRefsProtocol Web5 handle. */
+    refs: TypedWeb5<typeof ForgeRefsProtocol.definition, ForgeRefsSchemaMap>;
+    /** The repo's contextId (from the ForgeRepoProtocol repo record). */
+    repoContextId: string;
+};
+/** Callback for post-push ref synchronization. */
+export type OnPushComplete = (did: string, repo: string, repoPath: string) => Promise<void>;
+/**
+ * Create an `onPushComplete` callback that syncs git refs to DWN records.
+ *
+ * @param options - Ref sync configuration
+ * @returns An async callback to invoke after a successful push
+ */
+export declare function createRefSyncer(options: RefSyncOptions): OnPushComplete;
+/**
+ * Read all refs from a bare git repository using `git for-each-ref`.
+ *
+ * @param repoPath - Path to the bare git repository
+ * @returns Array of GitRef objects
+ */
+export declare function readGitRefs(repoPath: string): Promise<GitRef[]>;
+//# sourceMappingURL=ref-sync.d.ts.map

package/dist/types/git-server/ref-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-sync.d.ts","sourceRoot":"","sources":["../../../src/git-server/ref-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMrD,iDAAiD;AACjD,MAAM,MAAM,MAAM,GAAG;IACnB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;CACxB,CAAC;AAEF,gCAAgC;AAChC,MAAM,MAAM,cAAc,GAAG;IAC3B,+CAA+C;IAC/C,IAAI,EAAE,SAAS,CAAC,OAAO,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACzE,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;AAMnB;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAiDvE;AAMD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBrE"}

package/dist/types/git-server/server.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Git transport sidecar server.
+ *
+ * A standalone HTTP server that serves Git smart HTTP transport alongside
+ * a DWN.  Uses Node.js `http` module for maximum compatibility.
+ *
+ * Usage:
+ * ```ts
+ * import { createGitServer } from '@enbox/gitd/git-server/server';
+ *
+ * const server = createGitServer({
+ *   basePath : '/var/lib/gitd/repos',
+ *   port     : 9418,
+ * });
+ *
+ * console.log(`Git server listening on port ${server.port}`);
+ * ```
+ *
+ * @module
+ */
+import { GitBackend } from './git-backend.js';
+/** Configuration for the git transport sidecar server. */
+export type GitServerOptions = {
+    /** Base directory for storing bare repositories. */
+    basePath: string;
+    /** TCP port to listen on. Use 0 for a random available port. @default 9418 */
+    port?: number;
+    /** Hostname to bind to. @default '0.0.0.0' */
+    hostname?: string;
+    /** Optional path prefix for the HTTP handler (e.g. `/git`). */
+    pathPrefix?: string;
+    /**
+     * Optional authentication callback for push operations.
+     * @see GitHttpHandlerOptions.authenticatePush
+     */
+    authenticatePush?: (request: Request, did: string, repo: string) => Promise<boolean>;
+    /**
+     * Optional callback invoked after a successful push.
+     * @see GitHttpHandlerOptions.onPushComplete
+     */
+    onPushComplete?: (did: string, repo: string, repoPath: string) => Promise<void>;
+    /**
+     * Optional callback invoked when a repo is not found on disk.
+     * Implementations can restore the repo from DWN bundle records.
+     * @see GitHttpHandlerOptions.onRepoNotFound
+     */
+    onRepoNotFound?: (did: string, repo: string, repoPath: string) => Promise<boolean>;
+    /**
+     * Maximum request body size in bytes for POST requests (git pack data).
+     * @default 50 * 1024 * 1024 (50 MB)
+     */
+    maxBodySize?: number;
+};
+/** A running git server instance. */
+export type GitServer = {
+    /** The TCP port the server is listening on. */
+    port: number;
+    /** The git backend managing repositories. */
+    backend: GitBackend;
+    /** Stop the server. Returns a promise that resolves when fully closed. */
+    stop(): Promise<void>;
+};
+/**
+ * Create and start a git transport sidecar server.
+ *
+ * @param options - Server configuration
+ * @returns A promise resolving to a running GitServer instance
+ */
+export declare function createGitServer(options: GitServerOptions): Promise<GitServer>;
+//# sourceMappingURL=server.d.ts.map

package/dist/types/git-server/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/git-server/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAS9C,0DAA0D;AAC1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IAEjB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAErF;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnF;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,qCAAqC;AACrC,MAAM,MAAM,SAAS,GAAG;IACtB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IAEb,6CAA6C;IAC7C,OAAO,EAAE,UAAU,CAAC;IAEpB,0EAA0E;IAC1E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AAMF;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwGnF"}

package/dist/types/git-server/verify.d.ts

@@ -0,0 +1,12 @@
+/**
+ * DID-based signature verification for push authentication.
+ *
+ * Resolves a DID document, extracts the Ed25519 authentication key,
+ * and verifies the signature. This is the production implementation
+ * of the `SignatureVerifier` callback used by `createPushAuthenticator`.
+ *
+ * @module
+ */
+import type { SignatureVerifier } from './auth.js';
+export declare function createDidSignatureVerifier(): SignatureVerifier;
+//# sourceMappingURL=verify.d.ts.map

package/dist/types/git-server/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/git-server/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAuCnD,wBAAgB,0BAA0B,IAAI,iBAAiB,CA6B9D"}

package/dist/types/github-shim/helpers.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Shared helpers for the GitHub API compatibility shim.
+ *
+ * Provides DID-to-numeric-ID hashing, `from` option building, repo
+ * record lookup, GitHub-style owner objects, pagination, and standard
+ * response headers.
+ *
+ * @module
+ */
+import type { AgentContext } from '../cli/agent.js';
+/** GitHub-style owner sub-object synthesized from a DID. */
+export type GitHubOwner = {
+    login: string;
+    id: number;
+    type: string;
+    avatar_url: string;
+    html_url: string;
+    url: string;
+};
+/** Repo metadata extracted from a DWN repo record. */
+export type RepoInfo = {
+    name: string;
+    description: string;
+    defaultBranch: string;
+    contextId: string;
+    visibility: string;
+    dateCreated: string;
+    timestamp: string;
+};
+/** Pagination parameters parsed from query string. */
+export type PaginationParams = {
+    page: number;
+    perPage: number;
+};
+/** Standard JSON API response shape. */
+export type JsonResponse = {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+};
+/**
+ * Deterministic numeric ID from a DWN string identifier.
+ *
+ * Uses a simple FNV-1a-inspired hash to produce a positive 32-bit
+ * integer — sufficient for GitHub API compatibility where consumers
+ * expect numeric IDs.
+ */
+export declare function numericId(id: string): number;
+/**
+ * Build the `from` option for a DWN query.  When the target is the
+ * local agent's own DID we omit `from`; otherwise set it so the SDK
+ * routes the message to the remote DWN.
+ */
+export declare function fromOpt(ctx: AgentContext, targetDid: string): string | undefined;
+/**
+ * Look up the singleton repo record for a target DID.  Returns `null`
+ * if no repo record exists.
+ */
+export declare function getRepoRecord(ctx: AgentContext, targetDid: string): Promise<RepoInfo | null>;
+/**
+ * Build a GitHub-style owner sub-object from a DID.  The DID itself is
+ * used as the `login` field since DIDs are globally unique identifiers
+ * (just like GitHub usernames).
+ */
+export declare function buildOwner(did: string, baseUrl: string): GitHubOwner;
+/**
+ * Build the base API URL from request context.  Defaults to
+ * `http://localhost:<port>` for local development.
+ */
+export declare function buildApiUrl(url: URL): string;
+/** Parse `page` and `per_page` from the URL query string. */
+export declare function parsePagination(url: URL): PaginationParams;
+/** Apply pagination to an array and return the slice. */
+export declare function paginate<T>(items: T[], params: PaginationParams): T[];
+/** Build Link header value for pagination. */
+export declare function buildLinkHeader(baseUrl: string, path: string, page: number, perPage: number, totalItems: number): string | null;
+/** Standard headers for all GitHub API shim responses. */
+export declare function baseHeaders(): Record<string, string>;
+/** Build a successful JSON response. */
+export declare function jsonOk(data: unknown, extraHeaders?: Record<string, string>): JsonResponse;
+/** Build a 404 JSON response. */
+export declare function jsonNotFound(message: string): JsonResponse;
+/** Build a 201 Created JSON response. */
+export declare function jsonCreated(data: unknown, extraHeaders?: Record<string, string>): JsonResponse;
+/** Build a 422 JSON response (validation error). */
+export declare function jsonValidationError(message: string): JsonResponse;
+/** Build a 405 Method Not Allowed JSON response. */
+export declare function jsonMethodNotAllowed(message: string): JsonResponse;
+/**
+ * Get the next sequential issue number.
+ * Returns `max(existing numbers) + 1`, or 1 if no issues exist.
+ */
+export declare function getNextIssueNumber(ctx: AgentContext, repoContextId: string): Promise<number>;
+/**
+ * Get the next sequential patch number.
+ */
+export declare function getNextPatchNumber(ctx: AgentContext, repoContextId: string): Promise<number>;
+/** Convert an ISO date string to GitHub's ISO 8601 format. */
+export declare function toISODate(dateStr: string | undefined): string;
+/** Build a 401 Unauthorized JSON response. */
+export declare function jsonUnauthorized(message: string): JsonResponse;
+/**
+ * Validate a Bearer token from the Authorization header.
+ * Returns `true` if the token matches `GITD_API_TOKEN`, or if
+ * no token is configured (open access).
+ */
+export declare function validateBearerToken(authHeader: string | null): boolean;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/types/github-shim/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/github-shim/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAMpD,4DAA4D;AAC5D,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAG,MAAM,CAAC;IACf,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,UAAU,EAAG,MAAM,CAAC;IACpB,QAAQ,EAAG,MAAM,CAAC;IAClB,GAAG,EAAG,MAAM,CAAC;CACd,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAG,MAAM,CAAC;IACd,WAAW,EAAG,MAAM,CAAC;IACrB,aAAa,EAAG,MAAM,CAAC;IACvB,SAAS,EAAG,MAAM,CAAC;IACnB,UAAU,EAAG,MAAM,CAAC;IACpB,WAAW,EAAG,MAAM,CAAC;IACrB,SAAS,EAAG,MAAM,CAAC;CACpB,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAG,MAAM,CAAC;IACd,OAAO,EAAG,MAAM,CAAC;CAClB,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAG,MAAM,CAAC;IAChB,OAAO,EAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,EAAG,MAAM,CAAC;CACf,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAO5C;AAMD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkBlG;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CASpE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAE5C;AAMD,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,gBAAgB,CAI1D;AAED,yDAAyD;AACzD,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,GAAG,CAAC,EAAE,CAGrE;AAED,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe/H;AAMD,0DAA0D;AAC1D,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUpD;AAED,wCAAwC;AACxC,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAMzF;AAED,iCAAiC;AACjC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAM1D;AAED,yCAAyC;AACzC,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAM9F;AAED,oDAAoD;AACpD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAMjE;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAMlE;AAMD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAalG;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAalG;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI7D;AAMD,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAM9D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAYtE"}

package/dist/types/github-shim/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * GitHub API compatibility shim — barrel exports.
+ *
+ * @module
+ */
+export { handleShimRequest, startShimServer } from './server.js';
+export type { ShimServerOptions } from './server.js';
+export { handleGetRepo, buildRepoResponse } from './repos.js';
+export { handleCreateIssue, handleCreateIssueComment, handleGetIssue, handleListIssueComments, handleListIssues, handleUpdateIssue } from './issues.js';
+export { handleCreatePull, handleCreatePullReview, handleGetPull, handleListPullReviews, handleListPulls, handleMergePull, handleUpdatePull } from './pulls.js';
+export { handleCreateRelease, handleGetReleaseByTag, handleListReleases } from './releases.js';
+export { handleGetUser } from './users.js';
+export { buildApiUrl, buildLinkHeader, buildOwner, fromOpt, getNextIssueNumber, getNextPatchNumber, getRepoRecord, numericId, paginate, parsePagination, toISODate, } from './helpers.js';
+export type { GitHubOwner, JsonResponse, PaginationParams, RepoInfo, } from './helpers.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/github-shim/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/github-shim/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,cAAc,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxJ,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,aAAa,EAAE,qBAAqB,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,OAAO,EACP,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,SAAS,EACT,QAAQ,EACR,eAAe,EACf,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,QAAQ,GACT,MAAM,cAAc,CAAC"}