@enbox/gitd 0.0.1

package/src/daemon/adapters/npm.ts

@@ -0,0 +1,47 @@
+/**
+ * npm registry shim adapter for the unified daemon.
+ *
+ * Wraps `handleNpmRequest()` behind the `ShimAdapter` interface.
+ *
+ * @module
+ */
+
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { AgentContext } from '../../cli/agent.js';
+import type { ShimAdapter } from '../adapter.js';
+
+import { handleNpmRequest } from '../../shims/npm/registry.js';
+
+// ---------------------------------------------------------------------------
+// Adapter
+// ---------------------------------------------------------------------------
+
+export const npmAdapter: ShimAdapter = {
+  id          : 'npm',
+  name        : 'npm registry',
+  defaultPort : 4873,
+  portEnvVar  : 'GITD_NPM_SHIM_PORT',
+  corsMethods : 'GET, OPTIONS',
+  corsHeaders : 'Authorization, Accept',
+  usageHint   : 'npm install --registry=http://localhost:{port} @did:dht:<id>/<package>',
+
+  async handle(ctx: AgentContext, req: IncomingMessage, res: ServerResponse): Promise<void> {
+    if (req.method !== 'GET') {
+      res.writeHead(405, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Method not allowed. This is a read-only registry shim.' }));
+      return;
+    }
+
+    try {
+      const port = (req.socket.address() as { port?: number })?.port ?? 4873;
+      const url = new URL(req.url ?? '/', `http://localhost:${port}`);
+      const result = await handleNpmRequest(ctx, url);
+      res.writeHead(result.status, result.headers);
+      res.end(result.body);
+    } catch {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Internal server error' }));
+    }
+  },
+};

package/src/daemon/adapters/oci.ts

@@ -0,0 +1,59 @@
+/**
+ * OCI/Docker registry shim adapter for the unified daemon.
+ *
+ * Wraps `handleOciRequest()` behind the `ShimAdapter` interface.
+ *
+ * @module
+ */
+
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { AgentContext } from '../../cli/agent.js';
+import type { ShimAdapter } from '../adapter.js';
+
+import { handleOciRequest } from '../../shims/oci/registry.js';
+
+// ---------------------------------------------------------------------------
+// Adapter
+// ---------------------------------------------------------------------------
+
+export const ociAdapter: ShimAdapter = {
+  id          : 'oci',
+  name        : 'OCI/Docker registry',
+  defaultPort : 5555,
+  portEnvVar  : 'GITD_OCI_SHIM_PORT',
+  corsMethods : 'GET, HEAD, OPTIONS',
+  corsHeaders : 'Authorization, Accept, Docker-Distribution-Api-Version',
+  usageHint   : 'docker pull localhost:{port}/did:dht:<id>/<image>:<tag>',
+
+  async handle(ctx: AgentContext, req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const method = req.method ?? 'GET';
+
+    if (method !== 'GET' && method !== 'HEAD') {
+      res.writeHead(405, {
+        'Content-Type'                    : 'application/json',
+        'Docker-Distribution-Api-Version' : 'registry/2.0',
+      });
+      res.end(JSON.stringify({
+        errors: [{ code: 'UNSUPPORTED', message: 'This is a read-only registry shim.', detail: null }],
+      }));
+      return;
+    }
+
+    try {
+      const port = (req.socket.address() as { port?: number })?.port ?? 5555;
+      const url = new URL(req.url ?? '/', `http://localhost:${port}`);
+      const result = await handleOciRequest(ctx, url, method);
+      res.writeHead(result.status, result.headers);
+      res.end(result.body);
+    } catch {
+      res.writeHead(500, {
+        'Content-Type'                    : 'application/json',
+        'Docker-Distribution-Api-Version' : 'registry/2.0',
+      });
+      res.end(JSON.stringify({
+        errors: [{ code: 'UNKNOWN', message: 'Internal server error', detail: null }],
+      }));
+    }
+  },
+};

package/src/daemon/index.ts

@@ -0,0 +1,16 @@
+/**
+ * Unified daemon — barrel exports.
+ *
+ * @module
+ */
+
+export type { DaemonConfig, ResolvedShimConfig, ShimAdapter, ShimConfig } from './adapter.js';
+export type { DaemonInstance, DaemonOptions } from './server.js';
+
+export { createAdapterServer, resolveConfig, startDaemon } from './server.js';
+export { builtinAdapters, findAdapter } from './adapters/index.js';
+
+export { githubAdapter } from './adapters/github.js';
+export { goAdapter } from './adapters/go.js';
+export { npmAdapter } from './adapters/npm.js';
+export { ociAdapter } from './adapters/oci.js';

package/src/daemon/server.ts

@@ -0,0 +1,204 @@
+/**
+ * Unified daemon server — starts one HTTP server per enabled shim adapter.
+ *
+ * The daemon manages the lifecycle of all shim servers from a single
+ * process.  It resolves configuration (JSON file, env vars, defaults),
+ * starts each enabled adapter on its assigned port, logs a status
+ * summary, and handles graceful shutdown on SIGINT/SIGTERM.
+ *
+ * Each adapter's server includes:
+ *   - CORS preflight handling (OPTIONS)
+ *   - A `/health` endpoint returning `{ status: 'ok', shim: '<id>' }`
+ *   - Delegation to the adapter's `handle()` method for all other requests
+ *   - Top-level error catching with 500 responses
+ *
+ * @module
+ */
+
+import type { Server } from 'node:http';
+
+import { createServer } from 'node:http';
+
+import type { AgentContext } from '../cli/agent.js';
+import type { DaemonConfig, ResolvedShimConfig, ShimAdapter } from './adapter.js';
+
+import { builtinAdapters } from './adapters/index.js';
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export type DaemonOptions = {
+  ctx : AgentContext;
+  config : DaemonConfig;
+};
+
+export type DaemonInstance = {
+  /** All running HTTP servers keyed by adapter id. */
+  servers : Map<string, Server>;
+
+  /** The resolved config for each adapter. */
+  resolved : ResolvedShimConfig[];
+
+  /** Gracefully shut down all servers. */
+  stop(): Promise<void>;
+};
+
+// ---------------------------------------------------------------------------
+// Config resolution
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve the effective configuration for every known adapter.
+ *
+ * Priority for port: config file > env var > adapter default.
+ * Priority for enabled: config file > `true` (all enabled by default).
+ */
+export function resolveConfig(
+  config: DaemonConfig,
+  adapters: readonly ShimAdapter[] = builtinAdapters,
+): ResolvedShimConfig[] {
+  return adapters.map((adapter) => {
+    const entry = config.shims?.[adapter.id];
+    const envPort = process.env[adapter.portEnvVar];
+
+    const envParsed = envPort ? parseInt(envPort, 10) : undefined;
+    const port = entry?.port
+      ?? (envParsed !== undefined && !Number.isNaN(envParsed) ? envParsed : undefined)
+      ?? adapter.defaultPort;
+
+    const enabled = entry?.enabled ?? true;
+
+    return { adapter, enabled, port };
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Server factory
+// ---------------------------------------------------------------------------
+
+/**
+ * Create an HTTP server for a single adapter.
+ *
+ * The server handles CORS preflight, `/health`, and delegates
+ * everything else to the adapter.  It does NOT call `server.listen()`
+ * — the caller is responsible for that.
+ */
+export function createAdapterServer(ctx: AgentContext, adapter: ShimAdapter): Server {
+  const corsMethods = adapter.corsMethods ?? 'GET, OPTIONS';
+  const corsHeaders = adapter.corsHeaders ?? 'Authorization, Accept, Content-Type';
+
+  return createServer(async (req, res) => {
+    const method = req.method ?? 'GET';
+
+    // CORS preflight.
+    if (method === 'OPTIONS') {
+      res.writeHead(204, {
+        'Access-Control-Allow-Origin'  : '*',
+        'Access-Control-Allow-Methods' : corsMethods,
+        'Access-Control-Allow-Headers' : corsHeaders,
+        'Access-Control-Max-Age'       : '86400',
+      });
+      res.end();
+      return;
+    }
+
+    // Health endpoint.
+    if (req.url === '/health') {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ status: 'ok', shim: adapter.id }));
+      return;
+    }
+
+    // Delegate to adapter.
+    try {
+      await adapter.handle(ctx, req, res);
+    } catch (err) {
+      console.error(`[daemon:${adapter.id}] Error: ${(err as Error).message}`);
+      if (!res.headersSent) {
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Internal server error' }));
+      }
+    }
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Daemon lifecycle
+// ---------------------------------------------------------------------------
+
+/**
+ * Start the unified daemon.
+ *
+ * Resolves configuration, starts one HTTP server per enabled adapter,
+ * registers SIGINT/SIGTERM handlers, and returns the `DaemonInstance`
+ * for programmatic control and testing.
+ */
+export async function startDaemon(options: DaemonOptions): Promise<DaemonInstance> {
+  const { ctx, config } = options;
+  const resolved = resolveConfig(config);
+  const servers = new Map<string, Server>();
+
+  const enabledAdapters = resolved.filter((r) => r.enabled);
+
+  if (enabledAdapters.length === 0) {
+    console.log('[daemon] No shims enabled — nothing to start.');
+    return { servers, resolved, stop: async (): Promise<void> => {} };
+  }
+
+  // Start each enabled adapter.
+  const startPromises = enabledAdapters.map((r) => {
+    return new Promise<void>((resolve, reject) => {
+      const server = createAdapterServer(ctx, r.adapter);
+
+      server.on('error', (err: NodeJS.ErrnoException) => {
+        if (err.code === 'EADDRINUSE') {
+          console.error(`[daemon:${r.adapter.id}] Port ${r.port} is already in use — skipping.`);
+          resolve();
+        } else {
+          reject(err);
+        }
+      });
+
+      server.listen(r.port, () => {
+        servers.set(r.adapter.id, server);
+        resolve();
+      });
+    });
+  });
+
+  await Promise.all(startPromises);
+
+  // Print status summary.
+  console.log('[daemon] gitd daemon started');
+  console.log('');
+  for (const r of enabledAdapters) {
+    const running = servers.has(r.adapter.id);
+    const status = running ? `http://localhost:${r.port}` : 'FAILED';
+    console.log(`  ${r.adapter.name.padEnd(22)} ${status}`);
+    if (running && r.adapter.usageHint) {
+      console.log(`  ${''.padEnd(22)} ${r.adapter.usageHint.replace('{port}', String(r.port))}`);
+    }
+  }
+  console.log('');
+  console.log(`[daemon] ${servers.size}/${enabledAdapters.length} shims running. Health: GET /health on any port.`);
+  console.log('[daemon] Press Ctrl+C to stop.');
+  console.log('');
+
+  // Build the stop function.
+  const stop = async (): Promise<void> => {
+    const closePromises: Promise<void>[] = [];
+    for (const [id, server] of servers) {
+      closePromises.push(new Promise<void>((resolve) => {
+        server.close(() => {
+          console.log(`[daemon:${id}] stopped`);
+          resolve();
+        });
+      }));
+    }
+    await Promise.all(closePromises);
+    servers.clear();
+  };
+
+  return { servers, resolved, stop };
+}

package/src/git-remote/credential-helper.ts

@@ -0,0 +1,114 @@
+#!/usr/bin/env bun
+/**
+ * Git credential helper for DID-based push authentication.
+ *
+ * Git invokes credential helpers with a single argument: `get`, `store`, or
+ * `erase`. For `get`, the helper reads the request from stdin and writes
+ * credentials to stdout.
+ *
+ * This helper creates a DID-signed push token using the local Web5 agent's
+ * identity, formatted as HTTP Basic auth credentials:
+ *   username: did-auth
+ *   password: <base64url-signature>.<base64url-token>
+ *
+ * Usage in .gitconfig:
+ *   [credential "https://git.example.com"]
+ *     helper = /path/to/gitd-credential-helper
+ *
+ * Environment:
+ *   GITD_PASSWORD — vault password for the local agent
+ *
+ * @module
+ */
+
+import { Ed25519 } from '@enbox/crypto';
+
+import {
+  createPushTokenPayload,
+  DID_AUTH_USERNAME,
+  encodePushToken,
+  formatAuthPassword,
+} from '../git-server/auth.js';
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+/** Parsed credential request from git. */
+type CredentialRequest = {
+  protocol?: string;
+  host?: string;
+  path?: string;
+};
+
+// ---------------------------------------------------------------------------
+// Credential helper logic
+// ---------------------------------------------------------------------------
+
+/**
+ * Generate push credentials for a git request.
+ *
+ * @param request - The parsed credential request from git
+ * @param agentDid - The local agent's DID
+ * @param privateKeyJwk - The agent's Ed25519 private key (JWK)
+ * @returns The credential response to write to stdout, or undefined if not applicable
+ */
+export async function generatePushCredentials(
+  request: CredentialRequest,
+  agentDid: string,
+  privateKeyJwk: Record<string, unknown>,
+): Promise<{ username: string; password: string } | undefined> {
+  // Extract the owner DID and repo from the URL path.
+  // Expected path format: /<did>/<repo> or /<prefix>/<did>/<repo>
+  const path = request.path ?? '';
+  const segments = path.split('/').filter(Boolean);
+
+  // Find the DID segment (starts with "did:").
+  const didIdx = segments.findIndex((s) => s.startsWith('did:'));
+  if (didIdx === -1) { return undefined; }
+
+  const ownerDid = segments[didIdx];
+  const repo = segments[didIdx + 1];
+  if (!repo) { return undefined; }
+
+  // Create and sign the push token.
+  const payload = createPushTokenPayload(agentDid, ownerDid, repo);
+  const token = encodePushToken(payload);
+  const tokenBytes = new TextEncoder().encode(token);
+
+  const signature = await Ed25519.sign({
+    key  : privateKeyJwk as any,
+    data : tokenBytes,
+  });
+
+  const signatureBase64url = Buffer.from(signature).toString('base64url');
+
+  return {
+    username : DID_AUTH_USERNAME,
+    password : formatAuthPassword({ signature: signatureBase64url, token }),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// stdin/stdout protocol
+// ---------------------------------------------------------------------------
+
+/** Parse a git credential helper request from stdin lines. */
+export function parseCredentialRequest(input: string): CredentialRequest {
+  const result: CredentialRequest = {};
+  for (const line of input.split('\n')) {
+    const eqIdx = line.indexOf('=');
+    if (eqIdx === -1) { continue; }
+    const key = line.slice(0, eqIdx).trim();
+    const value = line.slice(eqIdx + 1).trim();
+    if (key === 'protocol') { result.protocol = value; }
+    if (key === 'host') { result.host = value; }
+    if (key === 'path') { result.path = value; }
+  }
+  return result;
+}
+
+/** Format a credential response for git. */
+export function formatCredentialResponse(creds: { username: string; password: string }): string {
+  return `username=${creds.username}\npassword=${creds.password}\n`;
+}

package/src/git-remote/credential-main.ts

@@ -0,0 +1,118 @@
+#!/usr/bin/env bun
+/**
+ * Git credential helper entry point for DID-based push authentication.
+ *
+ * Git invokes this binary with a single argument: `get`, `store`, or `erase`.
+ * For `get`, the helper reads the request from stdin (key=value lines) and
+ * writes credentials to stdout.
+ *
+ * This helper creates a DID-signed push token using the local Web5 agent's
+ * identity, formatted as HTTP Basic auth credentials:
+ *   username: did-auth
+ *   password: <base64url-signature>.<base64url-token>
+ *
+ * Install in .gitconfig:
+ *   [credential]
+ *     helper = /path/to/git-remote-did-credential
+ *
+ * Environment:
+ *   GITD_PASSWORD — vault password for the local agent
+ *
+ * @module
+ */
+
+import { Web5 } from '@enbox/api';
+
+import {
+  createPushTokenPayload,
+  DID_AUTH_USERNAME,
+  encodePushToken,
+  formatAuthPassword,
+} from '../git-server/auth.js';
+import {
+  formatCredentialResponse,
+  parseCredentialRequest,
+} from './credential-helper.js';
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+async function main(): Promise<void> {
+  const action = process.argv[2];
+
+  // Only handle `get` requests — `store` and `erase` are no-ops.
+  if (action !== 'get') {
+    return;
+  }
+
+  // Read the credential request from stdin.
+  const input = await readStdin();
+  const request = parseCredentialRequest(input);
+
+  // We only handle HTTP/HTTPS requests.
+  if (request.protocol && request.protocol !== 'https' && request.protocol !== 'http') {
+    return;
+  }
+
+  // Connect to the local agent to get the DID and signing key.
+  const password = process.env.GITD_PASSWORD;
+  if (!password) {
+    // Credential helpers must be non-interactive. If no password is set,
+    // silently exit and let git fall back to another credential helper.
+    return;
+  }
+
+  const { web5, did } = await Web5.connect({
+    password,
+    sync: 'off',
+  });
+
+  // Extract the owner DID and repo from the URL path.
+  const path = request.path ?? '';
+  const segments = path.split('/').filter(Boolean);
+  const didIdx = segments.findIndex((s) => s.startsWith('did:'));
+  if (didIdx === -1) { return; }
+
+  const ownerDid = segments[didIdx];
+  const repo = segments[didIdx + 1];
+  if (!repo) { return; }
+
+  // Create the push token.
+  const payload = createPushTokenPayload(did, ownerDid, repo);
+  const token = encodePushToken(payload);
+
+  // Sign the token using the agent's DID signer.
+  const signer = await web5.agent.agentDid.getSigner();
+  const tokenBytes = new TextEncoder().encode(token);
+  const signature = await signer.sign({ data: tokenBytes });
+  const signatureBase64url = Buffer.from(signature).toString('base64url');
+
+  const creds = {
+    username : DID_AUTH_USERNAME,
+    password : formatAuthPassword({ signature: signatureBase64url, token }),
+  };
+
+  process.stdout.write(formatCredentialResponse(creds));
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Read all of stdin until EOF. */
+function readStdin(): Promise<string> {
+  return new Promise((resolve) => {
+    let buf = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk: string) => { buf += chunk; });
+    process.stdin.on('end', () => resolve(buf));
+    process.stdin.resume();
+  });
+}
+
+main().catch(() => {
+  // Credential helpers must never crash loudly — silent exit on error
+  // lets git fall back to the next configured credential helper.
+  process.exit(0);
+});

package/src/git-remote/index.ts

@@ -0,0 +1,10 @@
+/**
+ * Git remote helper — DID-based remote transport for git.
+ *
+ * @module git-remote
+ */
+
+export * from './credential-helper.js';
+export * from './parse-url.js';
+export * from './resolve.js';
+export * from './service.js';

package/src/git-remote/main.ts

@@ -0,0 +1,74 @@
+#!/usr/bin/env bun
+/**
+ * git-remote-did — Git remote helper for DID-addressed repositories.
+ *
+ * This helper is invoked by Git when it encounters a `did::` or `did://`
+ * remote URL.  It resolves the DID to an HTTPS endpoint and delegates all
+ * git transport to `git-remote-https`.
+ *
+ * Usage (invoked by Git, not directly):
+ *   git clone did::dht:abc123/my-repo
+ *   git remote add origin did::dht:abc123/my-repo
+ *   git push origin main
+ *
+ * The helper:
+ *   1. Parses the DID from the URL
+ *   2. Resolves the DID document
+ *   3. Extracts the GitTransport or DWN service endpoint
+ *   4. Execs `git-remote-https` with the resolved HTTPS URL
+ *
+ * @module
+ */
+
+import { spawn } from 'node:child_process';
+
+import { parseDidUrl } from './parse-url.js';
+import { resolveGitEndpoint } from './resolve.js';
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+async function main(): Promise<void> {
+  const remoteName = process.argv[2];
+  const url = process.argv[3] ?? remoteName;
+
+  if (!url) {
+    console.error('git-remote-did: missing URL argument');
+    process.exit(1);
+  }
+
+  // Parse DID from URL.
+  let parsed;
+  try {
+    parsed = parseDidUrl(url);
+  } catch (err: unknown) {
+    console.error(`git-remote-did: ${(err as Error).message}`);
+    process.exit(1);
+  }
+
+  // Resolve DID → HTTPS endpoint.
+  let endpoint;
+  try {
+    endpoint = await resolveGitEndpoint(parsed.did, parsed.repo);
+  } catch (err: unknown) {
+    console.error(`git-remote-did: ${(err as Error).message}`);
+    process.exit(1);
+  }
+
+  console.error(`git-remote-did: resolved ${parsed.did} → ${endpoint.url} (via ${endpoint.source})`);
+
+  // Delegate to git-remote-https — it handles all the transport complexity.
+  const child = spawn('git', ['remote-https', remoteName, endpoint.url], {
+    stdio: 'inherit',
+  });
+
+  child.on('exit', (code) => {
+    process.exit(code ?? 128);
+  });
+}
+
+main().catch((err: Error) => {
+  console.error(`git-remote-did: fatal: ${err.message}`);
+  process.exit(128);
+});